docs(audit): add 2026-08-19 deep-dive audit report

[LeXwDeX]

Closes#355

What

docs/audit-dag-deepdive-2026-08-19.md — five-track deep-dive closing the first audit's limitation gaps:

1. fix(dag): httpapi exerciser teardown hang — DagSummaryPublisher event storm after dispose #316 trigger source — proven absent; closure rationale with effect-smol semantics evidence
2. loop.ts full re-read — 1738 lines covered; one Medium downgraded via cross-validation
3. DAG unaudited files — blocks/capture/recovery/workflows/admission/output-ref/tool/httpapi + 4 invariants (A fails structurally, B/C hold, D eroded by DAG-05)
4. Composition roots — GoalLoop/Sweep wiring holes on serve/web/desktop (F1/F2)
5. effect-smol v4 semantics — finalizer LIFO, forkIn-on-closed, catchCause/interrupt, timeoutOption, cached

Findings filed as #340–#350; issue mapping recorded in the report.