docs(stage2): correct S2-RO-07 integrated status

[Robinlee0929]

Summary

Correct stale lifecycle/status wording in the canonical S2-RO-07 immutable known-host snapshot documentation. Exactly one documentation file changes; no production or test code changes.

Lab2 compatibility result

S2-RO-07 Lab2 classification: REUSE_WITH_NEW_EXTERNAL_LAB2_DATA_ONLY.

Existing production implementation supports Lab2 unchanged. No production-code or test-code change is required. Exact target binding remains target_ref + address + port.

External Lab2 trust requirements

Future Lab2 use requires separately provisioned:

• exact Lab2 known-host source record;
• exact source path pin;
• exact FileId pin;
• exact complete-source SHA-256 pin;
• exact Lab2 Stage2FixedTargetEndpoint;
• exact Lab2 host-key record.

Lab2 must not reuse Lab1 standing host trust. No new known-host implementation, host-key algorithm, or trust subsystem is required.

Safety boundary

Stage2KnownHostSnapshot.execution_authorized remains False.

This PR does NOT establish:

• real Lab2 known-host material;
• real Lab2 host-key verification;
• SSH/live readiness;
• execution authority;
• full S2-RO-09 compatibility.

ANTI_ROLLBACK_STORAGE_PROTECTION remains NOT_PROVIDED.

Validation

Independent review: PASS / FINDINGS NONE.

Fresh Safe CI #34743435563, exact HEAD 4f2c0b6:

• Python: 3973 passed / 2 skipped / 0 failed (3975 collected)
• Node: 128 passed / 9 files
• Typecheck: PASS
• Lint: PASS
• Build: PASS
• Report-index: WARN / 1 pass / 13 optional missing / 0 fail / 0 unknown / workflow PASS
• Tracked mutation: PASS

The prior clean-copy docs-only INCOMPLETE exception was not reused by CI. Existing npm vulnerability and Next.js tracing warnings remain open; this PR does not remediate them.

Deferred

• real Lab2 known-host provisioning;
• S2-RO-09 full revalidation;
• S2-RO-10 runtime composition extension;
• Lab2 live proof;
• Stage 3.