docs: reconcile post-cutover verifier status

[Dynamicfeedai]

Summary

• record that the production active-only signing-key discovery cutover completed on 2026-07-11
• state that the former public key remains only in the lifecycle registry with compromised status
• separate the completed service cutover from still-pending package registry releases
• preserve the explicit statement that RFC 3161 and OpenTimestamps proofs are not independently validated

Validation

• tracked relative Markdown links resolve (13 files)
• README.md and SECURITY.md basic Markdown structure/whitespace checks pass
• python3 scripts/check_rotation_policy.py
• git diff --check

Scope

Documentation only. No package publication, production deployment, database change, or secret handling.