docs(governance): record AC-40 validator evidence

[tom-sapletta-com]

Records the exact Validator App, governance, merge, and full-diff historical-audit evidence that completes AC-40 in ticket-018.\n\nNo source, test, workflow, schema, or policy behavior changes.

[ifuri-validator-agent]

Deterministic Validator approval for exact head eb25408e9c4bdc0667452d08411d5082627350e2.

Ticket: ticket-018
Correlation ID: todo2code-pr-16-ac40-eb25408e
Model: openrouter/z-ai/glm-5.2
Reviewed diff chunks: 1
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 1 diff chunk(s). Documentation-only chunk for ticket-018 marking AC-40 complete. Updates README checklist, ai-codex-logs.txt, and ai-codex.md with Validator App review, governance, merge, and historical audit run evidence. No source, test, workflow, schema, or policy behavior changes. All provided checks pass.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge was not requested or performed.

[tom-sapletta-com]

Superseded by merged PR #17, which records the same AC-40 evidence together with the required TODO, changelog, ticket status, and immutable central pin updates. This branch is intentionally not merged.