Resolve open 1.01 research claims against primary sources

[jmanico]

Scope

1.01 research only. Follow-up to #1109 and #1184. No requirement, level, release metadata, or 1.0 changes.

What changed

The #1184 audit left about 350 claims unresolved. Each was reviewed in small batches against primary sources, and a claim was edited only when a fetched source settled it:

• 112 confirmed as written; a primary-source link was added where the claim had none.
• 130 corrected to match the primary source.
• 48 already fixed by earlier passes.
• 64 still unresolved and unchanged. They are now listed in REVIEW-STATUS.md so they are not mistaken for checked claims.

Examples of corrections:

• MITRE ATLAS v5.0.x (October 2025) has 15 tactics, 75 techniques, and 55 sub-techniques, per the atlas-data release; the page said 66 and 46.
• The nginx-ui CVE-2026-33032 fix is resolved from source: AuthRequired() was added to /mcp_message in v2.3.4, even though the advisory lists no patched version.
• The Five Eyes agentic AI guidance defines five risk categories, not the four in a law-firm summary, and the quoted recommendations now match the guidance text.
• Adversa's TrustFall disclosure is dated May 7, 2026, not June; SymJack's sixth affected tool is OpenAI Codex CLI.
• The OpenClaw "138 CVEs" figure is 138 advisories, 20 of them with CVE IDs, per the tracker snapshot.
• C2PA's training and data mining assertion entered the core spec in v1.3 and has been maintained as a CAWG assertion since v2.0; the page said it landed in v2.1.
• The "source-free certified unlearning" row now cites the paper itself (arXiv:2506.06486, ICML 2025) instead of a secondary summary, without the unsupported compute claim.

Validation

• Requirement rows: no text, ID, or level differences from 1.01-dev/en.
• Links: 617 relative links and anchors resolve.
• Tables keep their column counts; no new markdownlint findings relative to main; git diff --check is clean.