spec(pre-push-safety-net): record M1–M5 release milestones and split M1 into M1a/M1b

Add release-milestones.md as the executable outcome contract: prove one useful
Node detection, make it fast, verify PHP/Python transfer, qualify on untouched
cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net
steering, requirements, tasks, status and spec.json.

Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the
2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the
vulnerable/fixed/unchanged revisions under a task-local experimental flag that
records each veto instead of applying it, with a one-week box and a kill
criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired
and reruns through production rules. Existing approvals and thresholds unchanged.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.kiro/specs/pre-push-safety-net/requirements.md

@@ -2,6 +2,11 @@
 
 Status: approved for task generation on 2026-09-12 following the maintainer's "ok, next kiro phase". The acceptance profile defines evaluation targets, not measured achievements.
 
+Release sequencing amendment accepted 2026-09-14: [release milestones](release-milestones.md)
+defines M1 usefulness → M2 speed → M3 shared-language transfer → M4 independent qualification
+→ M5 narrow advisory rollout, with observable exit evidence. The requirements and numerical
+acceptance thresholds below remain unchanged.
+
 ## Introduction and Boundary
 
 OpenUltraSAST helps developers catch concrete security regressions in the resulting commits they