docs: CAMPAIGN 7 catalog sweep — audit, ROADMAP R-40/41/42, REPORT convention

Adds the CAMPAIGN 7 audit doc (53/53 apps deployed and validated on the demo box
through the real controller endpoints; 45 pass, 13 template fixes, ranked
findings) and the uninstall-semantics map row it proves out: remove requires stop
first, named docker volumes are ALWAYS destroyed including the DB, HDD data and
backups survive unless explicitly ticked, and the per-app offsite toggle outlives
the app while tier-2 config is cleared.

ROADMAP +3:
  R-40 the update path cannot express a multi-hop major upgrade (nextcloud
       forbids skipping majors; the template moved 31 -> 34)
  R-41 no standing 'does every template still deploy?' check -- the sweep was
       the first thing to try, and found 5 apps that had NEVER been deployable
  R-42 ruling needed on DB/cache sidecar majors (deliberately not bumped)

CLAUDE.md: REPORT.md is overwritten, so a second concurrent session in this repo
writes REPORT-<topic>.md instead -- applied to this run's own report.

Campaign 7 catalog sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

CLAUDE.md

@@ -73,6 +73,9 @@ pushes; **you (Claude Code) implement**. A file being open in the editor is NOT
 > **In every repository where you make a change, update both files in that repo:**
 > - **`CHANGELOG.md`** — cumulative log, newest on top (here: per-area `hub/`, `scripts/`, `website/`).
 > - **`REPORT.md`** — **overwrite** with the most recent implementation/validation summary only.
+>   **Parallel sessions:** `REPORT.md` is overwritten, so two sessions working in this repo at once
+>   will clobber each other. The second session writes **`REPORT-<topic>.md`** instead and never
+>   touches the shared `REPORT.md`.
 >
 > **Never write secrets** into any committed file — reference them as "stored out-of-band".