List only after-1.0 work in the README roadmap (closes #208)

The README roadmap and the TODO.md Next Step still described finished
1.0 work as remaining. The roadmap now lists only work planned after
1.0. The security item says the encryption and blob-generation code was
reviewed before 1.0 with every finding fixed, and keeps an outside audit
as after-1.0 work rather than a blocker. The error-condition item is
gone because every failure case it listed now has a fault-injection
test. TODO.md says the 1.0 work is complete on next and that merging to
main and tagging are the owner's; Future Steps points to the roadmap.

Judgement call: dropped the human-readable size flags item; no command
flag takes a raw-integer size.

Model: opus-5-5

README.md

@@ -577,22 +577,16 @@ complete annotated example also lives in
 
 ## roadmap
 
-Items still to do before / shortly after 1.0. Loosely ordered by
+Work planned after 1.0. Loosely ordered by priority.
-priority.
 
 ### correctness and operability
 
-* **Security audit of the encryption implementation.** Pre-1.0
+* **Outside security audit.** Before 1.0 the encryption and
-  blocker if we're advertising "secure" at the top of this README.
+  blob-generation code was reviewed and every finding fixed; no
-  age + zstd + content-defined chunking is mostly off-the-shelf
+  outside audit has been done. age + zstd + content-defined chunking
-  pieces, but the seams (key handling, recipient parsing, manifest
+  is mostly off-the-shelf pieces, but the seams (key handling,
-  trust boundary, restore-time identity validation) need an outside
+  recipient parsing, manifest trust boundary, restore-time identity
-  read.
+  validation) need an outside read.
-* **Error-condition tests.** Today's coverage is the happy path
-  plus a few specific regressions. Need fault-injection coverage:
-  network failures mid-blob, disk-full during restore, corrupted /
-  truncated / missing blobs, partial uploads, kill -9 between
-  manifest and db.zst.age writes.
 * **Verify restored content end-to-end in CI.** The current
   integration test does this for a small synthetic snapshot but
   not at scale. A nightly job against a multi-GB representative
@@ -620,8 +614,6 @@ priority.
 
 * **Man pages and richer `--help` examples.** Cobra generates
   basic help; man pages would be a separate target.
-* **`--bwlimit` style human-readable size flags** across the
-  command surface where they're currently raw integers.
 * **`vaultik snapshot diff <a> <b>`** — show which files changed
   between two snapshots without restoring either.
 * **Status reporting hook for `--cron`.** When a backup fails

TODO.md

@@ -14,14 +14,11 @@ pre-1.0
 
 # Next Step
 
-Define the remaining scope for the first tagged release under the 1.0.0
+The 1.0 work is complete on `next`: the scope settled on
-milestone, then cut that tag. The mechanism to cut it now exists and is
+[issue #125](https://git.eeqj.de/sneak/vaultik/issues/125) was the work
-exercised; what is left is the scope decision, which is the owner's.
+already planned for 1.0, and all of it has landed. The mechanism to cut
-This step deliberately names one version number: it previously said
+the tag exists and is exercised; what is left is merging `next` to
-"cut v0.1.0" while the `Makefile` baked in `1.0.0-rc.1` and the issue
+`main` and tagging, both the owner's.
-milestone said 1.0.0, and three different answers to "what is the next
-release" is exactly the contradiction
-[issue #65](https://git.eeqj.de/sneak/vaultik/issues/65) was filed over.
 
 # Completed Steps
 
@@ -693,4 +690,5 @@ release" is exactly the contradiction
 
 # Future Steps
 
-None queued; the release-scoping item is now the Next Step.
+Work planned after 1.0 is listed in the README
+[roadmap](README.md#roadmap).