docs(plan): record peer-auth decisions and evidence

Record the completed protocol-8 implementation, its security and lifecycle
decisions, and the final local acceptance evidence. Mark protocol-7 Call to
Play relay reviews as historical so they cannot be mistaken for current design.

Keep production acceptance honest by recording the unavailable canonical
186-game manifest corpus, real Windows/NTFS confinement and durability proof,
and representative physical-LAN evidence as external release prerequisites.

Test Plan:
- `just fmt` (passed)
- `just test` (passed; 708 workspace tests, including peer 480 and Tauri 56)
- `just clippy` (passed)
- `just frontend-test` (passed; 91/91)
- `just build` (passed; fixture-backed no-bundle build)
- `LANSPREAD_S37_MIN_MIB_PER_S=100 just peer-cli-tests` (passed; S1-S49)
- `git diff --cached --check` (passed)

organize/unsorted/FINDINGS.md

@@ -28,10 +28,10 @@ The previous four findings have landed in code and tests:
   startup recovery remove only exact downloader-owned paths and preserve unknown
   root files, instead of leaving crashed partial archives or broadly deleting
   the game root.
-- `update_game` now uses `PeerCommand::FetchLatestFromPeers` to skip local
-  manifest serving and fetch fresh peer metadata. Covered by
-  `update_fetch_emits_fresh_manifest_from_latest_peer` and
-  `update_request_skips_local_manifest_even_when_download_exists`.
+- Historical, superseded by the protocol-v8 cutover: `update_game` once used
+  `PeerCommand::FetchLatestFromPeers` and fresh peer metadata. That command and
+  its cited tests no longer exist; updates now use the local catalog manifest
+  and authenticated peers advertising its exact `ContentId`.
 - Download-to-install handoff no longer relies on `OperationGuard::Drop` for
   ordered state transitions. Covered by
   `download_handoff_waits_for_readers_and_auto_installs` and the liveness