chore(docs+devops): cross-module doc sync + sprint archival moves + compose updates

Bundled pre-session doc + ops work:
- docs/modules/**: sync across advisory-ai, airgap, cli, excititor,
  export-center, findings-ledger, notifier, notify, platform, router,
  sbom-service, ui, web (architectural + operational updates)
- docs/features/**: updates to checked excititor vex pipeline,
  developer workspace, quick verify drawer
- docs top-level: README, quickstart, API_CLI_REFERENCE, UI_GUIDE,
  code-of-conduct/TESTING_PRACTICES updates
- docs/qa/feature-checks/: FLOW.md + excititor state update
- docs/implplan/: remaining sprint updates + new Concelier source
  credentials sprint (SPRINT_20260422_003)
- docs-archived/implplan/: 30 sprint archival moves (ElkSharp series,
  misc completed sprints)
- devops/compose: .env + services compose + env example + router gateway
  config updates

File-level granularity preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/modules/platform/architecture.md

@@ -14,6 +14,7 @@ This module aggregates cross-cutting contracts and guardrails that every StellaO
 - **AOC & provenance**: services ingest evidence without mutating/merging; provenance preserved; determinism required.
 - **Offline posture**: Offline Kit parity, sealed-mode defaults, deterministic bundles.
 - **Platform Service**: aggregation endpoints for health, quotas, onboarding, preferences, and global search.
+- **Compatibility truthfulness**: Platform-owned aliases may aggregate or proxy real module contracts, but Platform must not ship synthetic notify admin payloads or fabricated quota/report data on live runtime routes.
 - **Observability baseline**: metrics/logging/tracing patterns reused across modules; collectors documented under Telemetry module.
 - **Determinism**: stable ordering, UTC timestamps, content-addressed artifacts, reproducible exports.
 
@@ -46,7 +47,7 @@ Current implementation status (2026-03-05):
 - `RiskEngine`: Postgres-backed result store (`riskengine.risk_score_results`) with explicit in-memory test fallback.
 - `Replay`: Postgres snapshot index + seed-fs snapshot blob store; startup rejects `inmemory` outside `Testing`, rejects `rustfs`, and rejects unknown object-store drivers.
 - `OpsMemory`: connection precedence aligned to `ConnectionStrings:OpsMemory -> ConnectionStrings:Default`, with non-development fail-fast.
-- `Platform`: Postgres-backed platform-owned state (`platform.*`, `release.*`) with explicit `Testing`-only in-memory fallback; startup rejects missing `Platform:Storage:PostgresConnectionString` outside `Testing`.
+- `Platform`: Postgres-backed platform-owned state (`platform.*`, `release.*`); startup rejects missing `Platform:Storage:PostgresConnectionString` outside `Testing`, and in-memory stores are injected only by explicit `Testing` harnesses.
 
 ## Platform Runtime Read-Model Boundary Policy (Point 4 / Sprint 20260305-005)