docs(checkpoint): wave A complete (P01-P03 shipped v0.11.1-v0.11.3)

---ci---
project: orca
phase: 3
milestone: v0.12
status: complete
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,19 +1,17 @@
 {
-  "phase": 0,
-  "stage": "ship",
+  "phase": 3,
+  "stage": "complete",
   "milestone": "v0.12",
   "milestone_slug": "security-hardening",
-  "phase_role": "pre_execution",
+  "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-07T09:00:00Z",
+  "updated_at": "2026-08-07T10:57:00Z",
   "milestone_complete": false,
   "previous_milestone": "v0.11",
-  "research_docs_ingested": 1,
-  "locked_decisions": {"D-238": "v0.12 minor", "D-239": "bundled Dex + BYO", "D-240": "WebAuthn", "D-241": "seal-to-OIDC + Shamir", "D-242": "auth-code+PKCE", "D-243": "Traefik RP ID", "D-244": "SQLite 0600 public keys", "D-245": "device-code fallback", "D-246": "credentials.json 0600", "D-247": "accept-identity-migration gate"},
-  "grill_verdict": "PROCEED-WITH-CONDITIONS",
+  "wave": "B (P04-P08 zero-trust identity) next",
+  "phases_shiped": ["P0", "P1", "P2", "P3"],
+  "tags_shipped": ["v0.11.0", "v0.11.1", "v0.11.2", "v0.11.3"],
   "binding_conditions": ["C-29", "C-30", "C-31", "C-32", "C-33", "C-34", "C-35", "C-36", "C-37", "C-38"],
   "phase_count": 29,
-  "load_bearing_rule": "R-021",
-  "threat_model_findings": 25,
-  "new_requirements": "REQ-119..REQ-148"
+  "load_bearing_rule": "R-021"
 }