docs: record R013 landed evidence and remaining live checks

[Knucklessg1]

R013 had no scoped evidence entries even though Kubernetes preflight, the read-only first-boot verifier, and Helm extension fixes were merged. Record the exact PR #23–25 merge and CI receipts, verified against main 937d385, and list the remaining profile, identity, secrets, registry-pull, CNI, and recovery checks.

R013 remains BUILDING and the spec remains SPECIFIED/NOT_AUDITED. R005 and all other requirement entries are unchanged. Source fixtures and Helm rendering do not establish deployment acceptance; the verifier always returns not_qualified.

Validation:

• Independent review approved the exact two-file content hashes.
• Public-spec schema, requirement IDs, links, and state-preservation checks passed.
• Normal configured commit hooks and pre-push hooks passed without bypasses, including the actual branch push.
• No local implementation suite rerun, local engine build, cluster action, or runtime acceptance was performed for this documentation change.
• Hosted Release run 37202068303 passed gates, scanner quality and build on exact head 08b4fb9e33b2ee488634cc2a50ac5346a4015d93. Required checks were green and refreshed main remained 937d38569cef9f07abf46fd064aff98c24a33c85 before merge.