docs(status): record public CI security coverage validation

docs/PROJECT_STATUS_RU.md

@@ -11,13 +11,23 @@ backup, registry-readiness документации, плана российск
 ## Текущий baseline
 
 - Baseline commit: `4970d31 chore(public): add CI coverage security and OSS process visibility`.
+- Public validation after hardening commit:
+  `4f90aba chore(security): harden public secret scan and document policy`.
 - Primary Russian Git:
   `https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus`.
 - GitHub:
   `public mirror / public validation only`.
+- Public CI status: passed.
+- Public coverage workflow: passed.
+- Public security workflow: passed.
+- Secret scan: hardened and passed.
+- GitHub Actions role: public mirror validation only.
 - Gitea operator account: `igor`; пароль/токены не входят в tracked files.
 - Основной доказательный пакет для registry-readiness:
   `docs/registry/`.
+- Public validation passed status does not constitute registry release evidence.
+- Registry release evidence still requires the Russian build-runner contour.
+- Russian build-runner still required for registry release evidence.
 
 ## Что готово
 
@@ -42,6 +52,8 @@ backup, registry-readiness документации, плана российск
   `scripts/check_release_evidence.sh`.
 - Добавлены публичные GitHub Actions workflow для CI, coverage baseline и
   security scanning.
+- Первый публичный GitHub Actions validation после hardening secret scan прошел
+  по контурам `CI`, `Coverage` и `Security`.
 - Добавлены `SECURITY.md`, `CONTRIBUTING.md`, `ROADMAP.md`, issue templates и
   pull request template.
 
@@ -67,12 +79,11 @@ backup, registry-readiness документации, плана российск
 
 ## Следующие рекомендуемые этапы
 
-1. Проверить первый публичный прогон GitHub Actions после push.
-2. Выполнить тестовое восстановление Gitea backup на отдельном сервере.
-3. Подготовить временный или постоянный российский build-runner
+1. Выполнить тестовое восстановление Gitea backup на отдельном сервере.
+2. Подготовить временный или постоянный российский build-runner
    `awatch-build-01`.
-4. Сформировать первый release evidence package на российском build-runner.
-5. Подготовить юридический пакет правообладателя для финальной проверки.
+3. Сформировать первый release evidence package на российском build-runner.
+4. Подготовить юридический пакет правообладателя для финальной проверки.
 
 ## Связанные документы
 

docs/QUALITY_STATUS_RU.md

@@ -13,6 +13,14 @@ Public GitHub Actions workflows are available for mirror validation:
 
 GitHub Actions is public mirror validation only. Public CI is not registry release evidence and is not the primary registry build contour.
 
+First public validation passed after
+`4f90aba chore(security): harden public secret scan and document policy`:
+
+- `CI`: passed.
+- `Coverage`: passed.
+- `Security`: passed.
+- Secret-pattern scan: hardened and passed.
+
 ## Coverage baseline policy
 
 Coverage threshold is not enforced yet. The first stage is tracking and
@@ -29,6 +37,9 @@ Registry release build and release evidence must be produced on the Russian
 build-runner described in
 `docs/registry/RU_BUILD_RUNNER_READINESS_RU.md`.
 
+Public validation passed does not replace Russian build-runner release
+evidence. Russian build-runner still required for registry release evidence.
+
 ## Security checks
 
 Public security checks are advisory/public validation. Registry release

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,26 @@
 # Registry readiness changelog
 
+## 2026-06-22 public GitHub Actions validation passed
+
+Changed:
+
+- Recorded first public validation passed after
+  `4f90aba chore(security): harden public secret scan and document policy`.
+- Documented passed public GitHub Actions contours: `CI`, `Coverage` and
+  `Security`.
+- Documented that the hardened public secret scan passed.
+- Reconfirmed that GitHub Actions remains public mirror validation only and is
+  not registry release evidence.
+- Reconfirmed that registry release evidence still requires the Russian
+  build-runner contour.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
 ## 2026-06-22 Gitea duplicate status
 
 Changed:

docs/registry/registry-evidence-manifest.json

@@ -2,7 +2,7 @@
   "schema_version": 1,
   "product": "AWatch-rus",
   "status": "registry-readiness infrastructure evidence manifest",
-  "updated_at": "2026-06-21",
+  "updated_at": "2026-06-22",
   "primary_source_repository": "https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus",
   "primary_git_clone_url_https": "https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus.git",
   "primary_git_platform": "self-hosted Gitea",
@@ -75,8 +75,12 @@
   },
   "public_engineering_transparency": {
     "github_actions_ci": true,
+    "github_actions_ci_status": "passed",
     "coverage_baseline": true,
+    "coverage_workflow_status": "passed",
     "security_scanning": true,
+    "security_workflow_status": "passed",
+    "secret_scan_status": "passed",
     "issue_templates": true,
     "public_roadmap": true,
     "github_role": "public_mirror_validation_only",