docs: close P7 — security review of the P0–P1 diff, no findings

The Fable review of the send-log authorization, tryAdmit, session create and app-delete ordering against security.md found no further issues: every send-log query path states its scope and an empty scope matches nothing, rejected rows cannot consume rate-limit budget, the milter's nil-registry fail-open is test-only, and each failure residue of the reordered delete fails safe. Outcome recorded in security.md's header and the plan; nothing added to the accepted risks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -19,6 +19,16 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   Explanation only; no attempt counter and no panel knobs. Not yet
   implemented.
 
+### Security
+
+- The independent security review of the send-log authorization and
+  fail-closed fixes below (code-review plan § P7; reviewer model ≠ author
+  model) found no further issues: the domain scope holds on every query path,
+  a rate-limit refusal cannot consume window budget, and each failure residue
+  of the reordered application delete fails safe. Nothing was added to
+  [docs/security.md](docs/security.md) § Accepted risks; the review is
+  recorded in that file's header.
+
 ### Fixed
 
 - test (e2e): send-log status scrapers follow the badge markup in