record S-1/N-1 remediation status + the N-4 parenthetical correction

- review 001: §Status carries the remediation status (S-1 + N-1 landed
  in e86b8ba, OQ-TLS-09 open, probe permanent) and the N-4 correction
  summary; §S-1 remediation-task line updated; §N-1 marked remediated;
  §N-4 gains the corrected mechanism chain (rustls 0.23.41/0.23.44 send
  [RawPublicKey] iff the resolver's only_raw_public_keys() is true —
  no "offers both types" behavior exists; a raw-key client fails
  IncorrectCertificateTypeExtension against this verifier; the S-1
  probe presents the SPKI under the default X.509 offer instead)
- task fix-accept-any-cert-verifier-posture: drop the placeholder
  fill-in lines (Notes/Summary carry the actual record)
- task docs-pin-c1-c4-n3-n4: N-4 work item rewritten from the
  corrected chain so the implementing agent does not re-derive it;
  references point at the rustls source lines and the probe's
  resolver choice

tasks/fix-accept-any-cert-verifier-posture.md

@@ -109,8 +109,6 @@ finding, not a code-change mandate. What's missing:
 
 ## Notes
 
-> Agent fills this during implementation.
-
 - The probe used a tokio duplex pair + `TlsConnector`/`TlsAcceptor`
   (tokio-rustls, `tcp`-gated) rather than raw `complete_io` — same
   shape, cleaner await-based flow. The attacker client uses a
@@ -139,8 +137,6 @@ finding, not a code-change mandate. What's missing:
 
 ## Summary
 
-> Agent fills this on completion.
-
 **Landed (this task):**
 
 1. `src/server.rs` — `AcceptAnyCertVerifier` doc rewritten: a