Schedule the Round-3 deep audit (January 2027): the subsystems v4 reshaped

[luisgf]

Horizon: mid (dated: 2027-01) · Effort: S (scheduling) · 2026-07-17 roadmap analysis (round 3)

Round 2 (2026-07-10) was a five-subsystem deep-code audit; round 3 is deliberately a standards-calendar round with no new code audit — R2 was days old when it ran. The next full pass is scheduled instead of skipped:

• run the third full-repository audit (audit-loop workflow: every finding filed as an issue, each closed by a verified commit) in January 2027 — ~6 months after R2, once v4.0.0 has been out for a quarter and the December EUDI events have landed
• focus areas: the subsystems v4 introduced or reshaped — the verify_badge/publish_ob3 facades, cli_common + the unified openbadges front-end, the CachingDownloader, status-list signature binding (OB3 verify(check_status=True) does not verify the status list's own signature by default #213), _ob1_api — plus whatever the December checkpoint touched
• its findings seed Round 4

Refs #237 (round-2 tracking).