Log the audit fixes in TODO.md (closes #173)

Completed Steps gets one entry for each fix merged into next since
v1.0.0-rc2 that had none, newest first in landing order. Each entry says
what its landing commit says and carries that commit's date in UTC. The
five fixes that logged themselves before this issue's decision keep
their entries and get no second one. Status no longer says there are no
git tags.

Model: opus-5-5

TODO.md

@@ -31,11 +31,11 @@ https://git.eeqj.de/sneak/secret/milestone/12
   `secret unlocker add` shares, now ends "nothing was changed".
 - 2026-10-15: `secret init`, `secret vault create`, `secret unlocker add`, and
   `secret add`, `secret import` and `secret generate secret` with `--force` ask
-  for the mnemonic or passphrase, or unlock the vault, before they take the
-  state directory lock (https://git.eeqj.de/sneak/secret/issues/152). They did
-  so while holding the lock, so every other command that changes anything waited
-  at the prompt. Under the lock, `secret unlocker add` fails if the vault was
-  removed, or created again with another key, and refuses a GPG key added
+  for the mnemonic or passphrase and unlock the vault before they take the state
+  directory lock (https://git.eeqj.de/sneak/secret/issues/152). They asked and
+  unlocked while holding the lock, so every other command that changes anything
+  waited at the prompt. Under the lock, `secret unlocker add` fails if the vault
+  was removed, or created again with another key, and refuses a GPG key added
   meanwhile; a forced add of a secret created meanwhile lets go of the lock,
   gets the key and takes the lock again. `secret.CreatePGPUnlocker` takes the
   unlocked vault; `SetMnemonic` and `SetUnlockPassphrase` are gone.