Reviewed recent compiler changes and open code-scanning alerts against
compiler-threat-detection-spec.md conformance scope. No new CTR-* rule
was warranted; all reviewed findings are already-covered classes,
out-of-scope files, stale/false-positive claims, or non-security
smoke-test noise.

Add Section 7.4 Mapping Audit (2026-09-13) recording:
- #681/#678/#676/#675 (go/allocation-size-overflow): same in-process,
  schema-bounded capacity-hint class already assessed 2026-09-09/10.
- #679 (go/useless-assignment-to-field), #674/#669/#668/#667
  (go/bad-redirect-check): pkg/cli/ findings outside conformance scope.
- #663 (js/http-to-file-access): scripts/ build tooling, out of scope,
  already carries an in-code CodeQL suppression rationale comment.
- #652/#651 (workflow-go-graphql-injection-sprintf): stale against
  current pkg/cli/project_command.go, which already passes owner via
  GraphQL named variables, not fmt.Sprintf string interpolation.
- #657 (workflow-security-finding-1): explicit smoke-test dummy alert.
- #680 (workflow-out-of-context): stray commit artifacts
  (test_dup_import binary, tmp/smoke_test_22524436360.go,
  {outname}.f) — commit hygiene, not a compiler threat-detection gap.

Bump spec to 1.0.35 with Section 2 sync-table row and Section 10
change-log entry (audit-only, no CTR rule or lock-file change).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>