Remove completed remediation handoff and mark the review closed

The handoff brief was a work order for phases 2-5. That work is done, so the
document now describes a future that already happened and would misdirect
anyone who found it.

The review report itself had the same problem in weaker form: its findings read
as open. Adds a status banner marking it closed and retained for reasoning only.

The banner also records that two of its recommendations were wrong on contact.
The HIGH-03 fix as written would have stripped root-cause data from
ExecutionAttempt provenance, and the HIGH-01 fix had to preserve per-page
durability the report never mentioned. Leaving that unstated invites someone to
'restore' the report's version later.

Co-authored-by: Copilot App <[email protected]>

docs/reviews/README.md

@@ -15,8 +15,7 @@ Naming: `<YYYY-MM-DD>-code-review.md` for review reports, and
 ## Current
 
 - [`2026-08-23-code-review.md`](./2026-08-23-code-review.md) — full review. 0 critical,
-  4 high, 5 medium, 11 low.
-- [`2026-08-23-remediation-handoff.md`](./2026-08-23-remediation-handoff.md) — **start here
-  to continue the remediation work.** Phase 1 (all 4 high findings) is complete as of commit
-  `de18c2e`; the handoff covers Phases 2-5 with per-task acceptance criteria, the verification
-  baseline, and the environment gotchas needed to avoid re-deriving them.
+  4 high, 5 medium, 11 low. **All findings remediated.** Retained as a record of the
+  reasoning, not as a list of open work. Note that a few of its recommendations were
+  wrong on contact and were corrected during implementation; the code and the guard
+  tests are authoritative over the report text.