spec(pre-push-safety-net): record M1–M5 release milestones and split M1 into M1a/M1b

Add release-milestones.md as the executable outcome contract: prove one useful
Node detection, make it fast, verify PHP/Python transfer, qualify on untouched
cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net
steering, requirements, tasks, status and spec.json.

Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the
2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the
vulnerable/fixed/unchanged revisions under a task-local experimental flag that
records each veto instead of applying it, with a one-week box and a kill
criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired
and reruns through production rules. Existing approvals and thresholds unchanged.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

.kiro/steering/safety-net.md

@@ -3,6 +3,15 @@
 Updated 2026-09-12 from the maintainer's explicit direction. This direction supersedes the
 WordPress-first release framing in older steering; historical measurements remain historical.
 
+Release order accepted 2026-09-14: first prove one useful Node changed-code comparison
+with an analyzed quiet fixed twin, then make the same analysis fast, verify PHP/Python
+transfer, qualify independently, and enable only passing advisory capabilities. See
+[the milestone spec](../specs/pre-push-safety-net/release-milestones.md). We are at M1a
+(show the detection with vetoes recorded, one-week box), then M1b (repair only what fired);
+task counts and an experimental alpha tag do not establish release readiness. PMPro
+remains a core regression/development case; any PMPro core retune still requires frozen
+Node transfer evidence. This sequence supersedes older runtime-first next-step wording.
+
 ## Purpose
 
 AI accelerates code production. OpenUltraSAST should help developers catch concrete security