re-baseline the four pending remediation tasks against the ADR-007/008 tree

The tasks were decomposed (d7db6b1) before 49d4432/ac440f3 landed;
both commits touched exactly the areas the tasks reference. Fixes
grounded in verified sources (vendored rustls-acme 0.12.1, rustls-pemfile
2.2.0, rustls-native-certs 0.8.4) and a fresh cargo llvm-cov run:

- acme-event-loop-test: the termination assertion was impossible —
  rustls-acme's Stream for AcmeState never yields None
  (state.rs:407-412, poll_next_infinite + 2^16s backoff); the review's
  U-1 exit-condition premise is withdrawn and corrected in place.
  Replaced with timeout-bounded event collection, a reachable-arm
  inventory (Order warn, AccountCacheStore, Load/Parse error arms,
  DeployedCachedCert/CertCacheStore via deterministic DirCache file
  pre-seeding), and an explicit mark for the full-fake-CA arms.
  server.rs:135 flagged as unreachable dead code (delete or accept).
- coverage-cheap-closes: re-baselined per-line ground truth — original
  groups 1 and 5 are already closed by the handshake suites; group 2's
  TLS 1.3 half is covered, leaving the TLS 1.2 else-arm (client.rs:316);
  new group added for VerifyPresentedCertVerifier::verify_tls12_signature
  (server.rs:349-366, opened by ADR-008; required for the >=98% bar);
  AcceptAnyCertVerifier refs moved to server.rs:468-475 with the stale
  OQ-TLS-09 coordination caveat retired.
- docs-pin-c1-c4-n3-n4: N-4 re-scoped (the mechanism analysis already
  lives in ADR-007 + the resolver doc block; what remains is a short
  server-verifier note covering both verifiers); C-4 updated for
  ADR-007's negotiation-earlier failure point; added the
  FingerprintPinVerifier pop cross-ref update (post-ADR-008 the default
  verifier does verify possession).
- config-validation-and-trivia: added the feature-gate mechanics note
  for the C-3 test (a non-gated test passes vacuously under default
  features); refreshed drifted line refs with a re-grep advisory.
- review 001: Status block records OQ-TLS-09/-10 resolutions; U-1
  carries the termination correction; U-2 carries the supersession
  note. ADR-008 gains the suite-number-to-test-name mapping.

Verification: taskgraph validate 14 tasks; cargo doc --no-deps
warning-free; all edits docs-only (no code paths touched).

tasks/config-validation-and-trivia.md

@@ -16,7 +16,7 @@ Four small findings in one pass (all verified in the decomposition
 session):
 
 1. **C-2** — `acme-tls/1` is appended unconditionally
-   (src/server.rs:87-89); a caller who already includes it in `alpns`
+   (src/server.rs:91); a caller who already includes it in `alpns`
    gets it twice (probed: `alpn_protocols == [acme-tls/1, acme-tls/1]`).
    Harmless to rustls-acme's challenge dispatch today, but the
    duplication leaks into the wire config and the ACME/non-ACME
@@ -32,7 +32,13 @@ session):
    Err(TlsError::AcmeConfig("empty domain list".into())) }`) at
    construction is additive and cheap. Note: empty `contact` stays
    legal (RFC 8555 §7.3 allows zero-contact accounts) — do NOT
-   validate that.
+   validate that. **Mechanics note (2026-09-12 re-check): the new
+   test must be `#[cfg(feature = "acme")]`-gated like the existing
+   ACME tests — under default features the Acme arm already errors
+   with `AcmeConfig` for the *missing-feature* reason (pinned by
+   `new_acme_identity_without_feature_returns_config_error`,
+   server.rs), so a non-gated empty-domains test would pass
+   vacuously and prove nothing.**
 3. **N-6** — `tasks/*.md` and `docs/architecture/**` ship in the
    published package (`cargo package --list` re-verified). One-line
    `exclude` addition: `"tasks/`, `"docs/architecture/` per the
@@ -80,10 +86,13 @@ session):
 ## References
 
 - docs/reviews/001-implementation-review.md §C-2, §C-3, §N-6, §N-7
-- src/server.rs:87-89 (ALPN append), src/server.rs:62-76
+- src/server.rs:91 (the ALPN append), src/server.rs:64-145
   (`new_acme` — where the domains validation goes),
-  src/identity.rs:64-66 (`AcmeDirectory::Custom`), Cargo.toml:11
+  src/identity.rs:65 (`AcmeDirectory::Custom`), Cargo.toml:11
   (exclude list)
+- (line refs re-checked 2026-09-12 against the post-ADR-007/008 tree;
+  the file has shifted since the decomposition — re-grep before
+  editing rather than trusting these absolutely)
 
 ## Notes