Mark resolved findings in security-review.md

[zeevdr]

Description

.agents/context/security-review.md lines 53 and 384-389 still say findings #205/#206 are "tracked" or "in progress". With alpha.2's hardening work, the following findings are now resolved (per the corresponding closed issues):

• Finding 1, 2, 3, 5, 6, 9, 11, 12, 13, 16, 17 — closed in this cycle
• Helper extraction (refactor(config/schema/audit): extract resolveTenantWithAccess and errToStatus #270) and pluggable Guard chain (feat(authz): pluggable Guard interface + ChainGuard #269) — both shipped

The doc should reflect the current state: which findings are done, which are still open (e.g., #215 — sensitive flag at every read path), and which moved to deferred follow-up issues created by this audit (#A7, #A9 in the Security Review milestone).

Context

Surfaced in the 2026-04-30 pre-release audit (finding A26). Internal doc hygiene.

Acceptance criteria

• For each finding listed in .agents/context/security-review.md, add a status marker:
  • ✅ resolved (link to closing PR or issue)
  • 🔄 in progress (link to issue)
  • ⏳ deferred (link to follow-up issue)
• Note refactor(config/schema/audit): extract resolveTenantWithAccess and errToStatus #270 (helper extraction) and feat(authz): pluggable Guard interface + ChainGuard #269 (Guard chain) explicitly
• Confirm the open list matches the open issues currently in the "Security Review" milestone

References

• .agents/context/security-review.md:53, 384-389
• Open Security Review milestone: https://github.com/opendecree/decree/milestone/5