chore(spec): draft→RFC citation swap for Token Status List and SD-JWT VC; W3C errata sweep

[luisgf]

Value/Effort: low / XS — gated on the RFC numbers existing. The two remaining draft pins are both at the RFC Editor's door (verified 2026-07-17):

• Token Status List — IESG-approved 2026-06-04, in the EDIT queue; publication plausibly weeks away. Our pin is draft-21; the wire format is stable since -13, and the -16 verifier MUST (reject an out-of-bounds idx) is already enforced (src/openvc/status/token_status_list.py).
• SD-JWT VC — draft-17 (2026-07-06, our pin) passed WGLC and is in IESG AD Evaluation since 2026-07-15; RFC likely late 2026, with at most IESG-driven edits.

Scope (once per RFC, as each lands)

• Diff the published RFC against the pinned draft; record "no wire change" here (or, if there is one, that becomes its own conformance issue).
• Swap the draft citations for the RFC number across src docstrings, wiki, README, and the conformance tests' provenance notes.
• Run the W3C errata-register sweep for the six 2025-05-15 RECs while at it (zero errata as of 2026-07-17; now part of the pre-release ritual).

Gate

RFC publication — watch the datatracker pages for draft-ietf-oauth-status-list and draft-ietf-oauth-sd-jwt-vc. Until a number exists there is nothing to cite.