docs: record shadow transition boundary

Author: PatchGate Maintainers

docs/reviews/2026-08-20-g4-g0-audit.md

@@ -61,6 +61,14 @@ Missing: a live external consumer repository, fork E2E, live merge-group E2E,
 two consenting non-blocking shadow installations, public immutable Action tag
 and maintainer review of observed distribution/noise.
 
+On the current PR, the non-required Shadow Gate also fails at the expected
+trusted-base transition boundary: `pull_request_target` executes the workflow
+and local Action metadata from `main@a3745f6`, whose workflow still passes the
+empty `secrets.GITHUB_TOKEN`. The PR version changes this to the repository
+scoped `github.token`; the corrected shadow run can only be observed after the
+workflow change is merged. This failure is retained as evidence of the
+transition, not bypassed or counted as a passing shadow installation.
+
 ### P2 — G3 live snapshot is complete but non-ready
 
 The follow-up authorized smoke against public `daichunghy/patchgate#9` at PR