Log the audit fixes in TODO.md (closes #173)

Completed Steps gets one entry for each fix merged into next since
v1.0.0-rc2 that had none, newest first in landing order. Each entry says
what its landing commit says and carries that commit's date in UTC. The
five fixes that logged themselves before this issue's decision keep
their entries and get no second one. Status no longer says there are no
git tags.

Model: opus-5-5

TODO.md

@@ -31,11 +31,11 @@ https://git.eeqj.de/sneak/secret/milestone/12
   `secret unlocker add` shares, now ends "nothing was changed".
 - 2026-10-15: `secret init`, `secret vault create`, `secret unlocker add`, and
   `secret add`, `secret import` and `secret generate secret` with `--force` ask
-  for the mnemonic or passphrase, or unlock the vault, before they take the
+  for the mnemonic or passphrase and unlock the vault before they take the state
-  state directory lock (https://git.eeqj.de/sneak/secret/issues/152). They did
+  directory lock (https://git.eeqj.de/sneak/secret/issues/152). They asked and
-  so while holding the lock, so every other command that changes anything waited
+  unlocked while holding the lock, so every other command that changes anything
-  at the prompt. Under the lock, `secret unlocker add` fails if the vault was
+  waited at the prompt. Under the lock, `secret unlocker add` fails if the vault
-  removed, or created again with another key, and refuses a GPG key added
+  was removed, or created again with another key, and refuses a GPG key added
   meanwhile; a forced add of a secret created meanwhile lets go of the lock,
   gets the key and takes the lock again. `secret.CreatePGPUnlocker` takes the
   unlocked vault; `SetMnemonic` and `SetUnlockPassphrase` are gone.