ROADMAP: Round 13 (Phase 40) audit-hardening productionization

Adds Phase 40 — 25 sub-items capturing today's three-commit audit-hardening
pass (d1e3ee2, e306b2b, 325db86) plus a week-of-2026-05-18 external-signal
catch-up from Round 12's 2026-05-17 sweep.

- 40.1-40.9: nine already-shipped items (storage cache-init race, GM_cookie
  scheme validation, webNav dedup tab-redirect, installFromUrl scheme defense,
  wrapper-side Map LRU caps, storage quota-warn hysteresis, case-folded file-
  extension checks, publish.sh draft preservation, script-store XSS defang).
- 40.10-40.14: five deferred internal refactors (DNR orphan reconciliation,
  window.onurlchange monkey-patch stack-up, cloud sync Promise.race abort
  plumbing, src/types/messages.ts ResponseMap completeness, telemetry-free
  leak-probe DevTools surface).
- 40.15-40.25: eleven external-signal items (ScriptCat S3 sync, @run-at
  context-menu tolerance, C-indicator popup badge, chrome-webstore-upload v6
  cutover, fflate Zip64 fix, monaco dependency audit, WECG async_initialization
  + getAvailableLanguages tracking, Chrome 148 CVE wave, GM sourceURL lesson,
  adjacent-tool pattern harvest from Stylus/uBO Lite/Bitwarden/Vimium).

Plus: items-verified-already-fixed audit table (four stale CLAUDE.md entries),
bug-claims-investigated-and-rejected table (eight over-claims dismissed),
category coverage matrix, 22 net-new source URLs indexed 273-294.

Roadmap header bumped Round 12 (2026-05-17) -> Round 13 (2026-05-18).
Source floor 272 -> 294.

Author: SysAdminDoc