Record strict current RustSec audit and reconcile verified GLib gates

docs/ROADMAP.md

@@ -156,8 +156,10 @@ release. Keep their evidence and unchecked production gates intact.
 - [ ] Formatting, lint, tests and security/dependency review.
   - [x] Inventory locked Rust/npm advisories; prepare byte-verified compatible
     upstream GLib iterator backport for the Linux desktop dependency graph.
-  - [ ] Execute optimized Linux backport regressions and native desktop checks;
-    complete native runtime and source security review. See DEPENDENCY-REVIEW.md.
+  - [x] Execute optimized Linux GLib backport regressions: three tests and the owner-lifetime compile-fail test passed; stored log hash and all 121 upstream source files reverified.
+  - [x] Native Linux 0.1.4 desktop build and packaged CPU startup use the selected local GLib backport; native graphical interaction remains unchecked.
+  - [x] Execute cargo-audit 0.22.2 against both current lockfiles with a fresh RustSec database and warnings denied; zero vulnerability-class findings, two tracked maintenance notices and exit 1. See DEPENDENCY-REVIEW.md.
+  - [ ] Complete native graphical interaction and broader native runtime/source security review. No broad security gate is closed by these narrow checks.
 - [ ] CPU benchmarks: filename p95 <50 ms/1M records; text <150 ms/100K documents; semantic <500 ms on declared hardware.
 - [ ] Measure cold start, indexing throughput, RAM, disk and idle CPU.
 - [ ] Record the very first foreground query and distinct unseen queries after