docs: reconcile deep-audit evidence contracts

[gnanirahulnutakki]

Summary

• state exact OpenCost, approval-expiry, audit-paging, kubeconfig-exec, and Wave-1 R6 boundaries
• correct refusal-only alert documentation and its static annotation to mean a recent scraped sample, not an accepted event
• close stale Argo session checkpoints with exact commit, CI, CodeQL, review, security, and retrospective scan evidence
• repair the worker-pool timeout wording without changing any runtime contract

Closes #311.

Verification

• full make ci on exact e52e71a5e71a15bfeab3949184abc590d77b8bf2 base with pinned golangci-lint v2.12.2, govulncheck v1.6.0, and checksum-verified promtool v3.13.1
• Prometheus: nine portable rules and rule-unit fixtures pass; alert expression is unchanged
• focused approval tests: 10 race-detector passes after the final documentation correction
• isolated go mod tidy -diff: clean
• Trivy current-tree and exact historical feature-tree secret scans: zero findings
• exact 14-file CodeRabbit review found two valid evidence gaps; both are fixed. A fresh committed-diff review remains required before merge.
• SSH-signed DCO/GSTACK commit: d54b0be03a32c27153b9744b024c3a9723b2676f

Security and cost

This changes static evidence and alert annotation text only. It does not change alert firing logic, telemetry cardinality, connector-wave scope, IAM, credentials, networking, storage, egress, cloud resources, or recurring cost. README was updated because operator-visible cost and alert semantics changed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 784e04fd-3550-4335-92e3-8e9003cb0386

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/docs-audit-contract-drift-20260722

---

_{Comment @coderabbitai help to get the list of available commands.}