Public-flip audit: scrub audit-ticket prefixes + internal references + tighten README

URLs → git.sulkta.com. Audit-ticket prefixes (SPEC §N, audit Track X, vc=N
audit-fix, FIX (audit ...), PORT DEVIATION) stripped from comments — technical
reasoning retained. Build-host references softened.
README sheds marketing scaffolding + stale status tables.

rust/strawcore/src/runtime.rs

@@ -3,7 +3,7 @@
 // strawcore-core Downloader + Localization singleton so the extractor
 // has an HTTP client to use.
 //
-// Round-4 audit HIGH-1: the prior shape used `Once::call_once` and
+// the prior shape used `Once::call_once` and
 // silently swallowed errors. If the FIRST call ran while the network
 // stack wasn't ready (cold boot in airplane mode, SELinux denial on
 // first TLS init, transient resolver failure), the Once slot was
@@ -60,7 +60,7 @@ pub fn ensure_initialized() {
     // DownloaderMissing once from the extractor and recover on
     // the next user action; the alternative (blocking N tokio
     // workers for the full duration of a slow init) freezes the
-    // UI. Round-6 audit HIGH-2 was the regression on round-5's
+    // UI. was the regression on round-5's
     // mutex-first ordering.
     let _guard = match INIT_LOCK.try_lock() {
         Ok(g) => g,