docs: reconcile plans/ status against actual code state

Audited all 10 active plan docs against the codebase (not just commit
titles). 5 were fully shipped and stale-tagged "Planned"/"In Progress" —
moved to done/ with verification notes. The other 4 got corrected
Planned→In Progress status plus concrete remaining-gap notes so the next
pass doesn't re-derive what's already done.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

plans/2026-07-08-oikos-gaps-and-improvements.md

@@ -1,6 +1,14 @@
 # 2026-07-08 — Oikos gaps, broken things, and improvements
 
-**Status:** Planned
+**Status:** In Progress — audited 2026-07-11. Done: A1 (approval FK bug),
+A3 (Hermes→Nomos help text), D1 (`upsert_knowledge`), D4-partial (general
+`run` tool). Still open: A2 (notifier flooding/dedup), A4 (`resolveHost`
+dead code), A5 (`queryRows` stringly-typed columns), A6 (stale
+`get_state_snapshot` description), B1-B5 (enrollment auth, fake Infisical
+creds, `/query` mesh-only auth unenforced, insecure host key checking,
+optional `caller_pubkey`), D2/D3 (no `get_approval_status`/
+`list_pending_approvals`/signal ack-resolve-mute tools), E (README tool
+count, Caddyfile placeholders, NOMOS.md duplicate line).
 
 ## Goal