Two limitations a reader should not have to find in TASKS.md

Two limitations a reader should not have to find in TASKS.md "Cold assets remain discoverable" sits in the README's list of reasons to use this, with nothing beside it about how that was verified. It was verified against SeaweedFS and against a fake store with a controllable clock — the wire protocol and the state machine — and never against real Glacier, because the nightly that would do it has never had credentials. Somebody evaluating an archival claim will reasonably assume the archival storage they would actually use was involved. The delivery limitation is the same kind of thing: correct, deliberate, documented in DECISIONS.md, and the sort of surprise that belongs before someone deploys rather than after. One `damd` serves delivery for one tenant, because the signed claim carries no tenant and the design refuses rather than inferring one. Both are in the status block now, where the honest "there is no human login yet" already is. That paragraph is the reason the rest of the README is worth believing.