Complete the encrypted recovery release gate

[callumalpass]

Summary

• mark encrypted backup/recovery complete with immutable archive, automation, corrective, and durable-evidence references
• remove the now-closed recovery limitation from the internal audit package
• update KMS/encryption documentation with the live beta26 Sydney-replica result
• preserve platform signing as the sole open stable-release gate and retain independent-audit/single-operator limitations

Evidence

• archive workflow: https://github.com/mdbase-dev/mdbase-cloud-ops/actions/runs/30795956568
• semantic recovery automation: https://github.com/mdbase-dev/mdbase-cloud-ops/pull/56
• live-discovered corrections: https://github.com/mdbase-dev/mdbase-cloud-ops/pull/75 and https://github.com/mdbase-dev/mdbase-cloud-ops/pull/76
• structured evidence: https://github.com/mdbase-dev/mdbase-cloud-ops/pull/77

Verification

• Node 24 release-readiness and security-audit package tests (10/10)
• pnpm check:release-readiness reports only platform signing open
• JSON and diff validation

Production was not mutated.