fix: close CODE-REVIEW-33-r1 M1-M3

M1: the AC7 no-import test scans the whole src tree for the CURRENT dump
name (the old assertion checked the pre-rename string; proven by
execution — a planted fetch now turns it red).
M2: deduplicate the #33 paragraphs in both changelogs and ARCHITECTURE.
M3: the auditor's exit-3 statuses match the spec contract exactly
(migrate-*/deprecated-read); decision-required is live behaviour
awaiting #44, drop-on-validation is the backend's own job.

User-Visible: no
Issue: #33

scripts/config-audit.mjs

@@ -80,9 +80,12 @@ if (isMain) {
       // #33: exit-code contract — 0 = clean, 3 = migration available
       // (any finding whose status names a pending mechanism), 2 = invalid
       // input (unchanged). 3 is chosen to avoid colliding with 2.
+      // Exactly the statuses that NAME a pending migration (#33 spec rev3):
+      // decision-required fields (group_lights, exclude_integrations) are
+      // live supported behaviour awaiting a #44 decision, not legacy, and
+      // drop-on-validation is handled by the backend itself.
       const MIGRATION_STATUSES = new Set([
         'migrate-on-write', 'migrate-on-settings-save', 'deprecated-read',
-        'drop-on-validation', 'decision-required',
       ]);
       const migrationFindings = reports.some((report) => report.findings
         .some((finding) => MIGRATION_STATUSES.has(finding.status)));