chore(work): finish 06-codeql-and-audit-signatures

docs/work/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-14T17:54:43.702Z",
+  "updated_at": "2026-05-14T17:56:41.640Z",
   "epics": {
     "2026-05-13-binder-wrap-helper": {
       "status": "done",
@@ -100,10 +100,10 @@
           ]
         },
         "06-codeql-and-audit-signatures": {
-          "status": "in-progress",
+          "status": "done",
           "title": "CodeQL workflow + pnpm audit signatures",
           "ac_total": 2,
-          "ac_completed": 1,
+          "ac_completed": 2,
           "depends_on": [],
           "blocks": [
             "08-reviewer-prompt-update"
@@ -260,13 +260,13 @@
   "ready": [
     {
       "epic": "2026-05-14-ci-security-and-supply-chain",
-      "story": "06-codeql-and-audit-signatures",
-      "title": "CodeQL workflow + pnpm audit signatures"
+      "story": "07-gitleaks-precommit",
+      "title": "Gitleaks pre-commit hook"
     },
     {
       "epic": "2026-05-14-ci-security-and-supply-chain",
-      "story": "07-gitleaks-precommit",
-      "title": "Gitleaks pre-commit hook"
+      "story": "08-reviewer-prompt-update",
+      "title": "Sandcastle reviewer prompt update"
     },
     {
       "epic": "2026-05-14-ci-security-and-supply-chain",
@@ -274,15 +274,6 @@
       "title": "CI security guide + CLAUDE.md"
     }
   ],
-  "blocked": [
-    {
-      "epic": "2026-05-14-ci-security-and-supply-chain",
-      "story": "08-reviewer-prompt-update",
-      "title": "Sandcastle reviewer prompt update",
-      "waiting_on": [
-        "2026-05-14-ci-security-and-supply-chain/06-codeql-and-audit-signatures"
-      ]
-    }
-  ],
+  "blocked": [],
   "needs_prd_ship": []
 }