audit(trg): record flake.nix SupplyChain is already CLOSED

Re-ran panic-attack assail with Nix 2.34.6 installed on the dev
machine: 11 weak points, 11 suppressed, 0 active. SupplyChain no
longer appears in the category list. The flake.lock file was
already generated and committed in eb57952 — the blocker had
cleared; the documentation was stale.

Audit addendum now records:
  - flake.nix SupplyChain ✅ CLOSED (with reproduction steps)
  - Two remaining cross-cutting blockers (Parser-fuzz + 17 RSR
    workflows) still gated on GitHub Actions billing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

audits/audit-trg-2026-04-18.md

@@ -252,8 +252,9 @@ is resolved and evidence collection begins for the parser-fuzz
 
 ## Addendum — 2026-04-18 (late afternoon) — delta re-audit
 
-**Trigger met**: canonical-proof-suite moved +1 passing since the
-snapshot above.
+**Triggers met**: canonical-proof-suite moved +1 passing since the
+snapshot above AND `panic-attack assail` confirmed zero active findings
+(all 11 weak points suppressed).
 
 ### What moved
 
@@ -291,15 +292,23 @@ building the missing analytic layer, not renaming hypotheses"):
   canonical proof is Isabelle; the Rocq port is not turn-key.
   Same scope-decision gate as S3/S4.
 
-### Cross-cutting blockers unchanged
+### Cross-cutting blockers
 
 - **Parser-fuzz ≥24h clean-run evidence** — strictly blocked on
   GitHub Actions billing on `hyperpolymath` (YOUR-ACTIONS-todo.md
   §1). No change since the main audit body.
 - **17 RSR workflows green** — same billing gate.
-- **flake.nix SupplyChain finding** — strictly blocked on Nix
-  install on the dev machine (YOUR-ACTIONS-todo.md §1b). No
-  change since the main audit body.
+- **flake.nix SupplyChain finding** — ✅ **CLOSED**. `flake.lock`
+  was generated and committed in `eb57952 deps: add flake.lock
+  to pin flake inputs`. Re-ran `panic-attack assail` on 2026-04-18
+  late afternoon with Nix 2.34.6 installed: **11 weak points
+  total, 11 suppressed, 0 active**. SupplyChain is no longer in
+  the category list at all — the blocker simply lags in the
+  documentation. Live evidence in `/tmp/assail.json` at run time;
+  reproducible by `panic-attack assail . --output report.json
+  --output-format json` followed by
+  `jq '[.weak_points[] | select(.suppressed == false)]' report.json`
+  (returns `[]`).
 
 ### Headline grade