docs: refresh security scanning references

docs/release/codeql_and_secret_scanning_policy_reference.md

@@ -3,6 +3,11 @@
 Date: 2026-04-08
 Scope: Repository planning guidance for GitHub-native security scanning policy during and after the residual alert wave.
 
+Current status:
+
+- the repository now uses the committed advanced CodeQL workflow as its authoritative scanner baseline
+- GitHub `Code scanning` and `Secret scanning` were both brought back to `0` open findings during the `S91` closeout
+
 ## 1. Why CodeQL Belongs in GitHub Actions
 
 This repository has a large security surface:
@@ -31,6 +36,7 @@ GitHub-hosted validation should own:
 - code-scanning alert lifecycle
 - long-running static dataflow analysis
 - alert triage over the default branch
+- secret-scanning closure workflow when a finding is confirmed to be historical or non-live
 
 ## 3. Recommended CodeQL Rollout Model
 

docs/release/github_codeql_baseline_reference.md

@@ -32,6 +32,7 @@ This note records the repository decision for GitHub CodeQL rollout and the spec
 
 ## Operational Notes
 
-- The repository currently shows CodeQL alerts generated by GitHub's dynamic/default setup pipeline.
-- Committing `codeql.yml` creates the repository-owned advanced-setup baseline, but the repository owner may still need to switch GitHub Security settings from default setup to advanced setup if the UI-managed default remains authoritative.
+- The repository now uses the committed `.github/workflows/codeql.yml` workflow as the authoritative advanced CodeQL baseline.
+- GitHub `default setup` was switched to `not-configured` during `S91`, so scanner policy now lives in version control instead of the repository UI.
+- The first successful advanced-baseline runs completed on `main` during the residual security closeout wave.
 - Local acceptance for CodeQL workflow changes must use repo-local seam tests against the workflow contract; do not require a full local CodeQL run unless a future task explicitly asks for it.

docs/release/github_security_residual_wave_reference.md

@@ -5,10 +5,15 @@ Scope: Residual GitHub Security findings that remained open after the first `S73
 
 ## 1. Purpose
 
-This reference captures the follow-up repair strategy for the residual GitHub Security findings that still point at the current `main` branch after the initial CodeQL / Dependabot cleanup wave.
+This reference captures the follow-up repair strategy that was used for the residual GitHub Security findings that still pointed at `main` after the initial CodeQL / Dependabot cleanup wave.
 
 This document is planning-only guidance. It is not itself an implementation record.
 
+Closure note:
+
+- this intake reference is now historical context only
+- the residual wave was closed during `S91`, with GitHub `Code scanning` and `Secret scanning` reduced to `0` open findings on 2026-04-08
+
 ## 2. Current Residual Findings Baseline
 
 Authenticated GitHub Security review showed this residual baseline at intake: