docs(reports): point the reports index and work log at the vuln issues

The audit's vulnerability clusters are now filed on Gitea as
dank/command-center#67..#77, one issue per host-and-package cluster. Link
them from omp-docs/reports/index.md and record the PR/issue references on
the matching log.md entry, so a reader of the audit can find the open work
without leaving the bundle.

omp-docs/log.md

@@ -39,7 +39,11 @@ the OpenSSH advisory count (0 → **5** unpatched CVEs; the first query omitted
 
 Laws: **an empty OSV response is not a clean bill** — verify the query shape against the distro
 tracker before writing "0 advisories"; and **a version quoted from a subagent gets re-probed
-before it enters a report**, this being the second mis-attribution the audit caught.
+before it enters a report**, this being the second mis-attribution the audit caught. Merged as PR
+[dank/command-center#66](https://gitea.franksdank.cloud/dank/command-center/pulls/66); the remediation
+clusters are filed as issues
+[dank/command-center#67](https://gitea.franksdank.cloud/dank/command-center/issues/67)–#77, listed in
+[reports/index.md](reports/index.md).
 
 ### reviewing a day of work, and finding checks that lie
 

omp-docs/reports/index.md

@@ -10,3 +10,16 @@ pages are the working data they were built from. The bundle-wide work log stays
 | [vuln-dankclaw.md](vuln-dankclaw.md) | reference | CVE/GHSA pass for the 33 Dankclaw quadlet images and the Ubuntu 26.04 host — the evidence base the audit's Dankclaw rows rest on. |
 | [vuln-dankserver.md](vuln-dankserver.md) | reference | CVE/GHSA pass for Dankserver (containers + host), blankpad's Arch package set, and danklivingroom's OpenSSH. |
 | [sleep-wake-investigation-report.html](sleep-wake-investigation-report.html) | report | blankpad suspend/resume investigation, 2026-09-28. |
+
+Open remediation work is tracked as Gitea issues, one per host-and-package cluster:
+[#67](https://gitea.franksdank.cloud/dank/command-center/issues/67) Ubuntu OpenSSH on both servers ·
+[#68](https://gitea.franksdank.cloud/dank/command-center/issues/68) gnome-remote-desktop + rpcbind ·
+[#69](https://gitea.franksdank.cloud/dank/command-center/issues/69) SurrealDB ·
+[#70](https://gitea.franksdank.cloud/dank/command-center/issues/70) Alpine image bases ·
+[#71](https://gitea.franksdank.cloud/dank/command-center/issues/71) Pi-hole ·
+[#72](https://gitea.franksdank.cloud/dank/command-center/issues/72) Valkey ·
+[#73](https://gitea.franksdank.cloud/dank/command-center/issues/73) copyparty ·
+[#74](https://gitea.franksdank.cloud/dank/command-center/issues/74) redis ·
+[#75](https://gitea.franksdank.cloud/dank/command-center/issues/75) radiance-vllm ·
+[#76](https://gitea.franksdank.cloud/dank/command-center/issues/76) danklivingroom SSH ·
+[#77](https://gitea.franksdank.cloud/dank/command-center/issues/77) blankpad unfixed AVGs.