docs(state): correct Task 15 source provenance

PROJECT_STATE.md

@@ -20,7 +20,7 @@
   Unix and Windows rather than POSIX-mode assumptions.
 - Final tested source is `e20bf33e2a00102192e5be66b178037aeca3a7b1`; fix-round-2 commits
   `fe190e7046acc173f510dddcb32f46ed142858c1` and follow-up
-  `4d230b840f99f33005a7c66566c16c48177e990b` remain intact in history. The final unified Docker
+  `4d230b87afdcd24f02264f8f937c8628b92db05a` remain intact in history. The final unified Docker
   smoke is PASS for run `20260818054002-16619-2452`, including maintenance auth isolation,
   restore, registry lifecycle, rollback, five-image revalidation, and task-scoped cleanup.
 - PASS on pinned Node `v24.16.0`: provider security fixture 6/6 and current authentication/F1
@@ -33,11 +33,11 @@
   default/unified Compose and secret-policy contracts; final unified Docker smoke and cleanup.
   Native execution of the Windows-only owner-DACL test was unavailable and remains PENDING.
 - Durable sanitized evidence is tracked at `.artifacts/task-15/automated-gates.json`
-  (`73c5c4f2b497aeda114e725f718f1e542a4c05691bd9257b6e607e55b1d02236`),
+  (`af835ab5eb37951881cc526a9576eb5789af510e0e4f2806d4d8ed080fb70fba`),
   `.artifacts/task-15/unified-docker-images.json`
   (`835790fbff5980c494c32f4473b46675ce7d568e7e6e39e30000ff0400b4dbb7`), and
   `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md`
-  (`4d086bbecf4f20edd6df76a92909fc15b04996a1b2409e7d6ffef07c98684086`). Authentication smoke
+  (`ba4da7f5bfb445ffb0fcca4d0620786e001c4b892efae22b26cbb33b194c6a86`). Authentication smoke
   exercised no Docker images; the final unified run retained all five exercised image identities.
 - FAIL baseline evidence remains unchanged: Ruff reports 192 errors; MkDocs strict reports 69
   warnings; canonical/workspace install checks have existing wording mismatches; Pi user-auth