RISK-WP-0005 finished: the seven gaps closed

T01 fix tracking now reads the owner's workplan file and found two
findings the register should have known about. T02 incident and external
report intake, the latter routed since the address is not ours to create.
T03 the production transition defined by what is held rather than what
was announced. T04 the README stops claiming a surface. T05 escalation
carries a delivery state and is raised once when unacknowledged. T06
checked_by and a heartbeat, so a 1q rung cannot silently mean nobody
looked. T07 coverage: 7 of 117 repos have ever appeared in a finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/record_check.py

@@ -13,6 +13,7 @@ written down, which is the same rule the register applies to everyone else.
 from __future__ import annotations
 
 import datetime as dt
+import os
 import re
 import sys
 
@@ -62,6 +63,7 @@ def main(argv: list[str]) -> int:
         fail("outcome must be one of: clean, moved, defer")
 
     subs = {
+        "checked_by": os.environ.get("RISK_CHECKED_BY", os.environ.get("USER", "unknown")),
         "last_checked": stamp,
         "next_check": nxt.strftime("%Y-%m-%dT%H:%M:%SZ"),
         "cadence": new_rung,