security: locate legacy submodule objects without weakening coverage

docs/evidence/2026-10-13-netkingdom-security/forge-gitlink-local-copies.json

@@ -0,0 +1,13 @@
+{
+  "scope": "Commit-object existence only; no object content read, upload, restoration or scan.",
+  "checks": [
+    {
+      "submodule": "wiki",
+      "pinned_commit_present_in_workstation_copy": false
+    },
+    {
+      "submodule": "_issue-tracking/issue-facade",
+      "pinned_commit_present_in_workstation_copy": false
+    }
+  ]
+}

docs/evidence/2026-10-13-netkingdom-security/forge-missing-gitlink-object-search.json

@@ -0,0 +1,14 @@
+{
+  "scope": "Read-only commit-object existence search over the 167 directories in the post-expansion inventory; no remote fetch or content read. Does not cover deleted/unmanaged repositories or workstation copies.",
+  "target_pinned_commits": [
+    "70d7ec0cdcbdff1a41cc420e2c939f855fe7787b",
+    "8818df03d3d7be241c144fd839d90c4d7c0ba20a"
+  ],
+  "directories_checked": 167,
+  "matches": [
+    {
+      "repository_id": 13,
+      "target_index": 0
+    }
+  ]
+}