docs(reports): land the fleet security audit with its per-host vuln passes

Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.

Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.

kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.

omp-docs/log.md

@@ -24,6 +24,23 @@ long form.
 
 ## 2026-10-21
 
+### the audit grows an advisory table, and corrects three of its own numbers
+
+`omp-docs/reports/fleet-security-audit-2026-10-21.html` folds in the two per-host vulnerability
+passes ([reports/vuln-dankclaw.md](reports/vuln-dankclaw.md),
+[reports/vuln-dankserver.md](reports/vuln-dankserver.md)): the "Advisory cross-reference (in
+progress)" section is now the full matrix and the header links the working files. Three figures
+fell to re-probing — the mutable-tag census (17 → **19** Dankclaw manifests / 17 unique
+references, +4 on Dankserver; the vuln pass's 24 also counts rolling release tags as mutable),
+the OpenSSH advisory count (0 → **5** unpatched CVEs; the first query omitted the version epoch,
+`10.2p1` for `1:10.2p1`, and OSV answers `0 vulns` rather than "unknown"), and the Plex version
+("12.1.0" is Jellyfin's — `podman exec plex cat /build_version` reports
+`1.43.5.11029-6bf8af3f0-ls329`).
+
+Laws: **an empty OSV response is not a clean bill** — verify the query shape against the distro
+tracker before writing "0 advisories"; and **a version quoted from a subagent gets re-probed
+before it enters a report**, this being the second mis-attribution the audit caught.
+
 ### reviewing a day of work, and finding checks that lie
 
 Two-axis review (Standards / Spec) of 51 commits, 30 findings, on `fix/60-review-findings`.