docs(roadmap): mark Wave 1 shipped, document interim work + version d… #3

	name: pip-audit

	on:
	push:
	branches: [main]
	schedule:
	# Mondays at 07:00 UTC (one hour after spec-sync)
	- cron: "0 7 * * 1"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	audit:
	runs-on: ubuntu-latest
	# Non-blocking initially — surfaces CVEs without gating PRs/main pushes.
	# Flip to false once the noise floor is established.
	continue-on-error: true
	steps:
	# Third-party actions pinned to SHA per #93 precedent.
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Install uv
	uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1

	- name: Set up Python
	run: uv python install 3.12

	- name: Install dependencies
	run: \|
	uv sync
	# `uv sync` does not seed `pip` into the venv (uv has its own
	# resolver). pip-audit needs `pip` to introspect installed packages.
	uv pip install pip

	- name: Run pip-audit
	uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
	with:
	# Audit the resolved environment created by `uv sync`.
	virtual-environment: .venv

Provide feedback