wiki: record what the security sweep did not cover !286

#149 exists so the sweep's coverage is "a matter of record rather than memory". Both its findings are now fixed — #147 in v1.13.3, #148 in !283 — along with #173, found afterwards in the same milestone. So the issue is done, and closing it would take the record with it.

The "not covered, and why" list moves to the threat model as its own section, beside "Residual risks, accepted" but making a different claim: those are risks understood and accepted, these are areas nobody has looked at. A reader deciding how much the document is worth needs both.

Nothing here changes behaviour.

Stacked on !285.

Closes #149