List only after-1.0 work in the README roadmap (closes #208)

The README roadmap and the TODO.md Next Step still described finished
1.0 work as remaining. The roadmap now lists only work planned after
1.0. The security item says the encryption and blob-generation code was
reviewed before 1.0 with every finding fixed, and keeps an outside audit
as after-1.0 work rather than a blocker. The error-condition item is
gone because every failure case it listed now has a fault-injection
test. Daemon mode, which the owner put after 1.0, is added to the
roadmap. TODO.md says the 1.0 work is complete on next and that merging
to main and tagging are the owner's; Future Steps points to the roadmap.

Judgement call: dropped the human-readable size flags item; no command
flag takes a raw-integer size.

Model: opus-5-5

README.md

@@ -582,10 +582,8 @@ Work planned after 1.0. Loosely ordered by priority.
 ### correctness and operability
 
 * **Outside security audit.** Before 1.0 the encryption and
-  blob-generation code was reviewed: every bug the review found was
-  fixed, and the risks it accepted are listed in
-  [Accepted Risks](docs/REPOSTRUCTURE.md#accepted-risks). No outside
-  audit has been done. age + zstd + content-defined chunking
+  blob-generation code was reviewed and every finding fixed; no
+  outside audit has been done. age + zstd + content-defined chunking
   is mostly off-the-shelf pieces, but the seams (key handling,
   recipient parsing, manifest trust boundary, restore-time identity
   validation) need an outside read.