docs(research): mark B.8 (PR #43) + HTTP serve (PR #44) shipped in fallow + competitive-scan (#45)

- fallow.md row B.8 was ❌ Open; PR #43 shipped it. Updated to ✅ with implementation notes (rule.id taxonomy, location auto-detection, deferred frontmatter overrides).
- fallow.md MCP-server bullet said 'HTTP API stays in roadmap backlog'; PR #44 shipped it. Reworded; added a dedicated PR #44 bullet covering the new transport, shared tool/resource handlers, CSRF/DNS-rebinding guard, Zod validation at the HTTP boundary, and 404/500 status semantics.
- competitive-scan-2026-04.md '4. What moved to the roadmap': replaced 'HTTP API (codemap serve) — still backlog' with shipped rows for PR #43 + PR #44.
- Fixed broken anchor: cross-ref to fallow.md was #status-snapshot-as-of-2026-05-01 but the heading bumped to 2026-05-02 in PR #42.

Author: SutuSebastian

docs/research/competitive-scan-2026-04.md

@@ -71,8 +71,9 @@ Items the scan called out as "watch / defer / future" — most still live in [do
 - ✅ **MCP server wrapping `query`** — shipped as `codemap mcp` (agent-transports v1) in PR [#35](https://github.com/stainless-code/codemap/pull/35). Tool taxonomy, output shape, and resource catalog reserved for HTTP API to inherit.
 - ✅ **Recipes-as-content registry + project-local recipes (`.codemap/recipes/`)** — shipped in PR [#37](https://github.com/stainless-code/codemap/pull/37). Catalog gains `source` / `body` / `shadows` fields so agents see project overrides at session start.
 - ✅ **Targeted-read CLI (`codemap show <symbol>`)** — shipped as `show` + `snippet` siblings in PR [#39](https://github.com/stainless-code/codemap/pull/39).
-- See [`research/fallow.md` § Status snapshot](./fallow.md#status-snapshot-as-of-2026-05-01) for the full ship summary.
-- HTTP API (`codemap serve`) — still backlog
+- ✅ **`--format sarif` + `--format annotations`** — shipped in PR [#43](https://github.com/stainless-code/codemap/pull/43). GitHub Code Scanning + PR-inline annotations for any recipe row-set.
+- ✅ **HTTP API (`codemap serve`)** — shipped in PR [#44](https://github.com/stainless-code/codemap/pull/44). Same tool taxonomy as MCP, `POST /tool/{name}`, loopback default, optional `--token`.
+- See [`research/fallow.md` § Status snapshot](./fallow.md#status-snapshot-as-of-2026-05-02) for the full ship summary.
 - Watch mode (`codemap watch`) — still backlog
 - Cross-agent handoff artifact (speculative) — still backlog