docs(reviewer): update audit status + add finding-orchestration plan

Session 1 (2026-05-31) resolved 26 findings across Sonnet/Haiku/Opus; 298/298
CGAL tests green.  Bring the audit docs in line with reality:

- README.md: G0 banner now records that the original authors were contacted by
  email about porting/relicensing rights (awaiting reply); headline-status cells
  updated per finding; new "Session 1 — implemented" record; link to the plan.
- Per-audit resolution banners (api-performance, numerical-stability,
  input-validation, test-coverage, math-citation, thread-safety) + G0-blocked
  banners (cgal-submission, dependency-license).
- NEW finding-orchestration.md: the meta-plan mapping every finding to a session,
  an implementing model (Haiku/Sonnet/Opus by the "how much must be understood"
  rule), and an Opus review gate after each implementation session.  Records S1
  (done) and lays out S2–S6 so the next session can be picked up cold.

Docs only — no code change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

doc/reviewer/input-validation-audit-2026-05-31.md

@@ -10,6 +10,12 @@ which covered *internal* error propagation and the deliberate `throw` paths.
 
 Status legend: 🔴 Critical · 🟡 Important · 🔵 Polish
 
+> **✅ Resolution status (2026-05-31, Session 1):** **V1/V2/V4 ✅** (JSON parse +
+> field checks, XML stoi/stod guarded — all surface as `std::runtime_error` with
+> path), **V3 ✅** (NaN/Inf vertex-coordinate guard in `load_mesh`). **V5** (XML
+> strict-reject) and **V6** (DOF-size check) **open** — scheduled S3 in
+> [`finding-orchestration.md`](finding-orchestration.md). 298/298 tests green.
+
 > **Threat model:** this is a scientific library, not a network service, so the bar
 > is "fail cleanly and diagnosably", not "resist attackers". But meshes and result
 > files routinely come from other tools, other people, and older versions of this