docs: retire the last two false gate-enforcement claims; scope the ranking heading

Closes the record-hygiene rider. Part 3 of the spec (documenting a
ROADMAP/OPEN-ITEMS state convention) is deliberately NOT done — its stated
evidence is false; see REPORT-record-correction-2026-07-29.md.

- CONTEXT.md:540 — "scripts/hub_confirm_gate.py enforces" was present tense
  about a gate invoked by nothing. Now says it asserts but is not enforced
  (R-29). Third instance of the class after :564 and configs.go:27.
- REUSE.md:62 — same claim, "enforces zero". The RULE stays (never native
  confirm()/prompt() is correct guidance and this is a reuse-reference row);
  only the enforcement claim changes, and it now says the rule holds only as
  long as you keep it.
- OPEN-ITEMS.md:4 — root REPORT.md is the overwritten per-session file;
  REPORT-<topic>.md is the non-clobbering sibling form (CLAUDE.md:82-87), of
  which 14 exist. The prohibition on durable content living only there stays.
- OPEN-ITEMS.md:55 — "Why the READY rows rank this way" promised a complete
  ordering and listed 5 of ~15 open rows. Scoped to TOP, with a half-sentence
  saying it is deliberately not a full ordering. No row added to the list.

hub/internal/web/configs.go:27 left alone (R-94 leg (b), needs a hub build).
No gate wired, run or fixed. Documentation only, no version bump, no CHANGELOG.

documentation/backlog/OPEN-ITEMS.md

@@ -1,8 +1,9 @@
 # OPEN-ITEMS — the single source of truth for open work
 
 **Rebuilt 2026-07-27 by read-only triage.** `ROADMAP.md` keeps the full history and reasoning; this
-page keeps only what is **open**, and it is the file to read first. `REPORT.md` is per-session and
-**overwritten** — nothing durable may live only there.
+page keeps only what is **open**, and it is the file to read first. Root `REPORT.md` is per-session
+and **overwritten** — nothing durable may live only there; a session that must not clobber it writes
+a non-overwritten `REPORT-<topic>.md` sibling instead (`CLAUDE.md:82-87`), of which 14 now exist.
 
 State: `BLOCKED` · `READY` · `WAITING-ON-OPERATOR` · `WATCHING`. Every row has an owner.
 
@@ -52,7 +53,10 @@ State: `BLOCKED` · `READY` · `WAITING-ON-OPERATOR` · `WATCHING`. Every row ha
 | **R-92** | Hub PBS-DR gauge is 0.1 GB-granular — small deltas unverifiable | READY (XS) | — | Widen precision when retention becomes customer-visible | CC |
 | **R-93** | `drill-r50` is both a blocked customer and the only drift fixture | READY (XS) | — | Retire it for a synthetic fixture, or unblock + silence per-customer | CC |
 
-## Why the READY rows rank this way
+## Why the TOP READY rows rank this way
+
+This covers the next few only — it is deliberately **not** a full ordering of the table above, so that
+there is one ranking to maintain rather than two.
 
 1. **R-95** — the largest *data* exposure: the tier holding the customer's documents and photos is the
    one whose credential can delete. The snapshot mitigation is now **armed** (daily 00:00, keep 7),