Record landed 1.0.0 work and drop the removed signing roadmap in TODO.md

Inbound signature verification was removed on next (#279), so the
Future Step proposing a Stripe HMAC scheme "landed with inbound
verification" proposed extending a subsystem that no longer exists, and
the Status section still counted #67 among the deployability gaps it
had closed. Both are gone.

Status now states the milestone honestly: open, 64 closed and 7 open,
with the tag held on #256 and a fix in review. The enumeration of open
follow-ups is dropped -- the tracker is the authoritative TODO and one
of the four listed issues had already closed.

Completed Steps gains the nine units that landed since the file was
last touched (#250, #254, #261, #221, #211, #262, #269, #253, #279) and
the 2026-08-20 units that were only ever summarised in Status prose or
missing entirely (#201, #200, #205, #206, #207, #234, #202, #203, #209,
#210, #208, #204, #233, #127).

#226 is closed on the tracker but is deliberately NOT recorded as
landed: no commit on next addresses it, and cleanShutdown still reads
s.httpServer and s.sentryEnabled unguarded.

TODO.md

@@ -18,18 +18,17 @@ Issue branches do NOT touch this file — the manager maintains it on
 
 # Status
 
-1.0.0 is open, with work remaining. The milestone
+1.0.0 is open: 64 closed, 7 open. As of `37b59f8`, the commit this one
-(https://git.eeqj.de/sneak/webhooker/milestone/9) is the authoritative
+follows, `next` is 72 commits ahead of `main` and a strict
-list and the only place to read a count from; this file deliberately
+fast-forward. No git tags exist yet.
-carries neither, because both drift between the commits that touch it.
-`next` is ahead of `main` and a strict fast-forward. No release has
-been tagged yet.
 
 The tag is held on a durability defect
 (https://git.eeqj.de/sneak/webhooker/issues/256): a concurrent reader
 of a per-webhook event database strands delivered webhooks at
 `pending`, and the next restart re-delivers them. A fix is in review
-(https://git.eeqj.de/sneak/webhooker/pulls/263).
+(https://git.eeqj.de/sneak/webhooker/pulls/263). The rest of the open
+milestone lives on the tracker, which is the authoritative list; this
+file does not duplicate it.
 
 One caveat on reading a green check: a docs-only commit deliberately
 replays from the layer cache