docs(roadmap): record Phase II steps 1-2 landed

[kyle-sexton]

What

Append the Phase II status line to the roadmap PLAN scope-change note: steps 1–2 landed (ci-workflows#189, standards#229 + sync #827, #825).

Why

This PR is ALSO the plan's step-1 sanity check: it is docs-only (matches none of the caller's 26 security-sensitive patterns), so it must show security-review / changes = pass and security-review / security-review = skipped (name-stable not-applicable verdict — not Pending, not absent). That observed result gets cited at the step-3 user gate before the ruleset PR opens.

No linked issue (status note; #509 completes at step 3).

Related

• autonomy pipeline: no dedicated security-review pass — automated code review only #509 — enforcement rail
• ci(security-review): adopt always-report shape — paths input replaces workflow-level filter #825, feat(claude-security-review): always-report shape — paths input + job-level relevance gate ci-workflows#189, ci(runner-policy): approve claude-security-review pin 99cb082 with paths input standards#229

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[claude]

Claude finished @kyle-sexton's task in 59s —— View job

---

PR Review

• Gather context
• Read changed file
• Review for correctness and CLAUDE.md alignment
• Post final feedback

---

Verdict: LGTM — approve and merge.

This is a docs-only, additive status update. No logic, no schema, no secrets, no plugin behavior affected.

What was added (PLAN.md L158–161):

A single continuation block inside the existing blockquote, recording that Phase II steps 1–2 landed, citing the relevant cross-repo PRs and the commit pin. The date format (ISO), blockquote continuation syntax (>), and narrative style all match the preceding scope-change note.

Accuracy check:

• ci-workflows#189 — reusable always-report shape with pin 99cb082 ✓
• standards#229 + sync #827 — runner-input contract review ✓
• #825 — this caller adopts paths, context verified live ✓
• Remaining items (this PR as skip-path sanity check, then step 3 behind user gate) match the PR description ✓

One minor observation (no action needed): the "Remaining" clause describes the state as of when steps 1–2 landed, so after this PR merges the "docs-only skip-path verification PR" item will already be done. That's intentional per the PR description — this PR IS that verification — but a future reader scanning the status line might briefly wonder. Not worth a re-word; it's a living doc and the gate note in step 3 will supersede it.

CLAUDE.md alignment: Docs-only change, no plugin manifests touched, no fresh-docs fetch required for this scope. Conventional Commits title (docs(roadmap): …) is correct for the repo's squash-merge policy.