docs(#2775): align package-legitimacy docs to the ADR-0656 registry-API gate (#3010)

* docs(#2775): align package-legitimacy docs to the ADR-0656 registry-API gate

security-model.md, USER-GUIDE.md, ARCHITECTURE.md, COMMANDS.md,
FEATURES.md, and gsd-planner.md's STRIDE template (+ ja-JP mirrors)
described the pre-ADR-0656 design: slopcheck as the install-or-degrade
gate, with unavailability degrading every package to [ASSUMED].
ADR-0656 inverted this months ago — registry-API verdicts (npm/PyPI/
crates.io) are the gate; slopcheck is an optional escalate-only adapter
that no shipped configuration wires. Verified every replacement claim
against src/package-legitimacy.cts (checkPackages, classifyPackage,
lookupNpm/lookupPypi/lookupCrates) via Memtrace before writing it, so
the corrected prose matches the live implementation rather than
restating the ADR from memory.

Restored docs/explanation/security-model.md:79-84 (and its ja-JP
mirror) to original wording after an orthogonal spec review caught
that an earlier draft had edited the "Why WebSearch packages are
always [ASSUMED]" paragraph — inside the range issue #2775 explicitly
named as correct and to leave alone.

The ja-JP mirror was missing the closing clause present in the
corrected English original ("its absence leaves registry-API verdicts
intact rather than downgrading everything to [ASSUMED]") — added for
parity. This completes the ja-JP mirror the issue's acceptance
criteria named explicitly.

zh-CN/ko-KR/pt-BR (not named by #2775, but carrying the same stale
design) get the mechanical portion of the same fix: command-string
swaps, table headers, ARCHITECTURE.md diagram labels, and technical-
term swaps that reuse a word already attested elsewhere in the same
file (合法性/적법성/legitimidade for "legitimacy") — surrounding prose
untouched. The remainder in those three locales — full-paragraph
rewrites of the corrected degrade-path mechanism, deleted "External
dependency" bullets, and "manually install slopcheck" code blocks —
needs prose composed by a fluent speaker of each language and is filed
as open-gsd/gsd-core#3002 with an exact file:line inventory.

* test(#2775): acknowledge gsd-planner.md byte growth from the STRIDE-row fix

agents/gsd-planner.md grew 14 bytes (49309 -> 49323) from the STRIDE
supply-chain row correction (slopcheck -> package-legitimacy gate).
Emitted agent/workflow files are byte-tracked; this fragment
acknowledges the growth per tests/emitted-attribution.test.cjs's
"differential attribution over the real tree" check.

* docs(#2775): close ja-JP FEATURES.md gap; fix a ko-KR transliterated heading

docs/ja-JP/FEATURES.md:2808 still read the katakana transliteration
"スロップチェック verdict" in REQ-PKG-GATE-01 — invisible to a literal
"slopcheck" grep, so it was missed when ja-JP parity was checked and
declared complete. Corrected to "正当性判定" (legitimacy verdict),
matching the term already established in ja-JP/explanation/
security-model.md and ja-JP/USER-GUIDE.md. This was the only
remaining ja-JP gap; a full sweep for the transliterated form across
docs/ja-JP/ now returns zero hits, and the ja-JP mirror is genuinely
at parity.

docs/ko-KR/USER-GUIDE.md:398's heading "슬롭체크 판정:" had the same
transliteration problem. Fixed inline to "적법성 판정:", reusing the
적법성/legitimacy word already attested two lines below in the same
table. A parallel sweep of zh-CN and pt-BR found no transliterated
forms of "slopcheck" in either locale. The remaining transliterated
occurrence in ko-KR (USER-GUIDE.md:406, the lead-in to the
pip-install code block) needs prose composition like the rest of that
block and is added to open-gsd/gsd-core#3002's inventory.

* chore(#2775): backfill changeset PR number to 3010

---------

Co-authored-by: sim <sim@local>

docs/explanation/security-model.md

@@ -54,11 +54,15 @@ researcher → planner → executor pipeline and eventually run as
 The gate operates across three pipeline stages:
 
 **Research stage.** When `gsd-phase-researcher` recommends external packages,
-it runs `slopcheck install <pkgs> --json` against each one. The results are
-written to a `## Package Legitimacy Audit` table in `RESEARCH.md`. Packages
-tagged `[SLOP]` (high-confidence hallucination or attacker-registered) are
-**stripped from `RESEARCH.md` entirely** before the file is saved. They never
-reach the planner.
+it runs `gsd-tools query package-legitimacy check --ecosystem <npm|pypi|crates>
+<pkgs>` against each one. Verdicts (`OK|SUS|SLOP`) are computed from live
+registry APIs against thresholds `{ minAgeDays: 30, minWeeklyDownloads: 1000,
+requireRepo: true }`, plus terminal short-circuits for non-existence and
+suspicious `postinstall` scripts. The results are written to a `## Package
+Legitimacy Audit` table in `RESEARCH.md`. Packages tagged `[SLOP]`
+(high-confidence hallucination or attacker-registered) are **stripped from
+`RESEARCH.md` entirely** before the file is saved. They never reach the
+planner.
 
 **Planning stage.** `gsd-planner` reads the Audit table. For any package
 tagged `[SUS]` (suspicious: newly registered, low download count, no source
@@ -85,12 +89,13 @@ gets a human review before installation.
 
 ### Ecosystem coverage
 
-The researcher uses registry-specific verification commands rather than a
-single generic check:
+The gate resolves signals directly from each ecosystem's registry API rather
+than a single generic check:
 
-- Node.js: `npm view`
-- Python: `pip index versions`
-- Rust: `cargo search`
+- Node.js: `registry.npmjs.org` (age, repository URL, `postinstall` script)
+  plus `api.npmjs.org/downloads` (weekly downloads)
+- Python: `pypi.org/pypi/<pkg>/json` (age, repository URL)
+- Rust: the crates.io API (age, weekly downloads, repository URL)
 
 This covers cross-ecosystem hallucination, which occurs at roughly 9 %
 according to 2025 USENIX research — cases where an AI recommends a package
@@ -98,17 +103,18 @@ that exists in one ecosystem but not the one actually in use.
 
 ### Graceful degradation
 
-If `slopcheck` is unavailable (not installed, or the pip install fails at
-research time), GSD applies the strictest possible fallback: **every
-recommended package is tagged `[ASSUMED]`**, and the planner gates every
-install with a `checkpoint:human-verify` task. Research and planning proceed
-normally — the system never hard-fails on a missing tool dependency. This
-is intentionally stricter than the normal flow: slopcheck unavailability means
-every package install gets a human checkpoint.
+Each registry adapter has a 5-second timeout and returns degraded (all-null)
+signals on a failed lookup rather than throwing. Missing signals surface as
+`unknown-age` / `unknown-downloads` reasons, which push a package to `[SUS]`
+— and `[SUS]` is gated behind the same `checkpoint:human-verify` task as
+`[ASSUMED]`. The gate fails toward human review, not silence, and research
+and planning proceed normally: nothing here hard-fails on a network or tool
+outage.
 
-The `slopcheck` tool is MIT-licensed and pip-installable. If it is ever
-abandoned, the `[ASSUMED]`-gate fallback ensures human-checkpoint coverage is
-maintained regardless.
+`slopcheck` is an optional adapter that can only escalate a verdict, never
+lower it, and is not the install-or-degrade gate. No shipped configuration
+wires it; its absence leaves registry-API verdicts intact rather than
+downgrading everything to `[ASSUMED]`.
 
 ---
 
@@ -242,9 +248,9 @@ attack.
 
 **What the Package Legitimacy Gate does not eliminate:** A legitimate package
 that is later compromised (account takeover, dependency confusion in its own
-tree) is not caught by slopcheck, which checks registration signals at
-research time. Lock files and `npm audit` at the dependency-integrity layer
-are the controls for that class of attack.
+tree) is not caught by the registry-API gate, which checks registration
+signals at research time. Lock files and `npm audit` at the
+dependency-integrity layer are the controls for that class of attack.
 
 **What the prompt injection defences reduce:** The probability that
 user-controlled text in planning artifacts successfully overrides agent