docs(work): archive shipped template epics and PRDs

Move the 8 shipped template epics and their 9 PRDs (incl.
coverage-architecture) to docs/work/archive/{epics,prds}/ so dispatch
context and prioritization only see live Veect work. The state builder
already walks docs/work/epics/ + docs/work/prds/ only; the one work-CLI
script that matched archive paths (bump-updated-timestamps.mjs, staged
docs/work/**/*.md) now excludes docs/work/archive/ so archived content
stays byte-identical.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

docs/work/archive/epics/ci-security-and-supply-chain/01-trace-schema-extensions/_story.md

@@ -0,0 +1,51 @@
+---
+id: 01-trace-schema-extensions
+epic: ci-security-and-supply-chain
+title: Trace schema extensions (socketRisk + lastRevalidated)
+type: technical-story
+status: done
+feature: scripts
+depends-on: []
+blocks:
+  [
+    02-socket-integration,
+    04-major-bump-reevaluation,
+    05-trace-revalidation-workflow,
+  ]
+created: 2026-05-14T18:59:12+02:00
+updated: 2026-05-14T19:21:52.308Z
+---
+
+## Goal
+
+Extend `scripts/library-decisions/schema.mjs` with two new fields — `socketRisk` (the 9th filter result) and `lastRevalidated` (ISO-date or null) — and update `docs/library-decisions/_template.md` to reflect the expanded schema.
+
+## Why
+
+Every downstream enforcement layer (the evaluate-library skill's 9th filter, the check.mjs major-bump mode, the revalidate.mjs weekly cron) depends on these two fields being present and validated at the schema layer first. Landing them here in one green commit before any consumer touches them prevents schema-drift between layers.
+
+**External dependency:** library-evaluation epic story 01 (trace schema foundation) must be complete before this story — `scripts/library-decisions/schema.mjs` and `docs/library-decisions/_template.md` must exist. That epic is marked done.
+
+## Done when
+
+- `scripts/library-decisions/schema.mjs` exports an updated Zod schema where `filter-results` includes `socketRisk: z.union([z.literal("clean"), z.literal("flagged"), z.string()])` and the trace frontmatter includes `lastRevalidated: z.string().nullable()` (ISO date or null).
+- `docs/library-decisions/_template.md` mirrors both new fields with inline documentation of their allowed values.
+- `schema.test.mjs` covers: `socketRisk` round-trips for all three variants (`clean`, `flagged`, arbitrary string); `lastRevalidated` accepts ISO date strings and `null`; a trace missing `socketRisk` in `filter-results` fails validation; `lastRevalidated: null` is valid (default for fresh adoptions).
+- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.
+
+## In scope
+
+- `scripts/library-decisions/schema.mjs` — schema additions only (no new exports, no breaking changes to existing field shapes).
+- `scripts/library-decisions/schema.test.mjs` — new test cases for the two new fields.
+- `docs/library-decisions/_template.md` — field documentation additions.
+
+## Out of scope
+
+- `socket-cli` invocation or Socket CI step — Story 02.
+- `check.mjs` major-bump mode — Story 04.
+- `revalidate.mjs` script — Story 05.
+- Backfilling existing traces with the new fields — Story 05 (the revalidation cron handles this on its first run).
+
+## Tasks
+
+- [x] Extend `scripts/library-decisions/schema.mjs` adding `socketRisk` (union: `"clean" | "flagged" | string`) to the `filter-results` Zod object and `lastRevalidated` (nullable ISO-date string) to the trace frontmatter schema; update `docs/library-decisions/_template.md` to document both fields with their enum values; add test cases to `schema.test.mjs` covering `socketRisk` round-trips (all three variants), `lastRevalidated` ISO + null acceptance, and missing-`socketRisk` rejection; all gates pass on this single commit.