Public-flip audit: scrub audit-ticket prefixes + internal references + tighten README

URLs → git.sulkta.com. Audit-ticket prefixes (SPEC §N, audit Track X, vc=N
audit-fix, FIX (audit ...), PORT DEVIATION) stripped from comments — technical
reasoning retained. Build-host references softened.
README sheds marketing scaffolding + stale status tables.

rust/strawcore/src/search.rs

@@ -58,9 +58,9 @@ pub async fn search(query: String) -> Result<Vec<SearchItem>, StrawcoreError> {
     // names, sometimes embarrassing) and android_logger emits at
     // info-level in release builds, which means they'd ride the
     // Settings → Export Logs path straight into a user's chat. Log
-    // shape, not content. vc=36 audit CVE HIGH-2.
+    // shape, not content.
     log::info!("strawcore::search query_len={}", query.len());
-    // Round-5 audit MED-1: ensure_initialized was only wired into
+    // ensure_initialized was only wired into
     // init_logging() so the 5s-backoff retry path never fired from
     // the hot entry points. Now every extractor entry re-asserts
     // — cheap when INITIALIZED is true (single Acquire load).