docs: reconcile M1 QEMU substrate pass and TRUST-1 gate statuses

[aien-dev]

Summary

Reconciles milestone status labels to eliminate conflation between component proofs and cryptographic security gates per TRUST-1 implementation planning:

• Marks M1 (UEFI/QEMU automated substrate boot proof) as PASS, verified by PR Add ACPI SPCR console discovery and QEMU AArch64 boot test harness #42 (SPCR/boot test harness) and PR Run QEMU boot test and verification suite in CI #44 (CI automation).
• Explicitly distinguishes M1 from TRUST-1 Gate 4 (emulator security test suite, 100-boot soak, fault injection).
• Reports Machine 1 core baseline as PASS (PR Record the Machine 1 core operational baseline #41).
• Sets TRUST-1 Gate 0 to IN PROGRESS (owner-controlled boot baseline, keyslot and TPM policy discovery).
• Sets TRUST-1 Gate 4 to PENDING.
• Clarifies next hard gate sequence: TRUST-1 Gate 0 -> Gate 1 recovery media -> Gate 4 security suite -> M3 kernel isolation.

Verification

• Verified against docs/TRUST-1-IMPLEMENTATION-PLAN.md.
• Zero disk secrets.
• Unslop compliance verified.