docs(program): record NET-10 FTP retirement

docs/program/BloomOS_Work_Program_v3.json

@@ -1166,12 +1166,13 @@
       "github_prs": [
         621,
         624,
-        627
+        627,
+        630
       ],
       "risk_tier": 3,
       "deployment_tier": "full",
       "device_gate_required": true,
-      "last_audited_main": "4e0267c4d6e1457cb5d22a127003d7a978d9557b",
+      "last_audited_main": "840d78a2e3f783e5d5d41e4020b2767e28ba9780",
       "evidence": [
         "GitHub PR #621 removes the dormant whole-card FileBrowser HTTP executable, database, web theme, icon, first-run marker, boot initializer, and start/authentication code from newly assembled stable payloads while retaining fail-closed legacy entrypoints, listener detection, and process cleanup for rollback-compatible remnants on older cards; it removes 15 tracked files and 14910652 bytes",
         "the corrected stable inventory contains 333 components, 1975 files, and 261293981 bytes with 232 source-build and 101 unresolved components; 74 affected Shell tests, three RetroArch identity tests, CI ARM orchestration and risk-scope tests, Python compilation, POSIX syntax, manifest, provenance, transfer policy, dependency inventory, and diff checks passed",
@@ -1183,7 +1184,11 @@
         "no device mutation was performed for PR #624; the older installed baseline's previously observed inherited Telnet listener is not claimed as remediated, the DISP-04 Shell overlay remains preserved, and NET-10 still requires the later coherent signed Full installation and rollback checkpoint",
         "GitHub PR #627 removes the stale FileBrowser HTTP and authentication state plumbing, default-credential copy, submenus, and visible Tweaks entry after PR #621 retired its runtime payload, and replaces current enablement instructions with a safe retirement route pointing to key-only SSH and SFTP while preserving versioned Onion 4.2 history, stale-state migration cleanup, listener detection, and older-card process termination",
         "the pinned Miyoo toolchain compiled the affected Tweaks consumer as a stripped 32-bit ARM EABI5 binary with SHA-256 72b79a3edcefa7d002bdd916ec9d926f3b7c26d253400ab3a7bd682089743371; affected Shell, branding, CI scope and ARM orchestration, scoped cppcheck, and diff checks passed, and after a retained diagnostic identified and corrected one deterministic stale branding assertion the final exhaustive local Shell gate passed 811 of 811 tests across eight shards in 151.20 seconds",
-        "PR #627 also classifies website-only changes as risk zero with no ARM, cppcheck, native, ASan, or Shell work because Docusaurus owns that boundary; GitHub checks passed with static analysis in 21 seconds, formatting in 28 seconds, affected ARM in 43 seconds, native tests in 1 minute 45 seconds, Docusaurus in 2 minutes 6 seconds, AddressSanitizer in 2 minutes 7 seconds, and hosted Shell in 2 minutes 18 seconds; it merged by squash as 4e0267c4d6e1457cb5d22a127003d7a978d9557b, no device mutation occurred, and NET-10 remains in progress pending the coherent signed Full device checkpoint"
+        "PR #627 also classifies website-only changes as risk zero with no ARM, cppcheck, native, ASan, or Shell work because Docusaurus owns that boundary; GitHub checks passed with static analysis in 21 seconds, formatting in 28 seconds, affected ARM in 43 seconds, native tests in 1 minute 45 seconds, Docusaurus in 2 minutes 6 seconds, AddressSanitizer in 2 minutes 7 seconds, and hosted Shell in 2 minutes 18 seconds; it merged by squash as 4e0267c4d6e1457cb5d22a127003d7a978d9557b, no device mutation occurred, and NET-10 remains in progress pending the coherent signed Full device checkpoint",
+        "GitHub PR #630 removes inherited bftpd and bftpdutmp executables, anonymous and authenticated FTP configurations, dormant start and authentication logic, the visible Tweaks FTP controls and default-credential copy, and current enablement instructions while retaining stale ftpState and authftpState cleanup, exact bftpd termination, fail-closed legacy entrypoints, and the reviewed key-only SFTP replacement; the stable inventory falls to 331 components, 1972 files, and 260959742 bytes with 232 source-build and 99 unresolved components",
+        "the pinned Miyoo toolchain compiled the affected Tweaks consumer as a stripped 32-bit ARM EABI5 binary with SHA-256 160a38cb2d663ea95c6fd635f20ecf7afd9eec9622b9e20b1f8707aeead4eb53; focused security and provenance gates passed 40 of 40 plus 11 of 11 tests, scoped cppcheck passed in 1.45 seconds, native and AddressSanitizer each passed 595 of 595 tests in 56.45 and 71.88 seconds, and the corrected exhaustive local Shell gate passed 813 of 813 tests across eight shards in 157.24 seconds",
+        "after one focused corrective commit restored a missing MDX details opener exposed by the first Docusaurus run, final GitHub checks passed with static analysis in 19 seconds, formatting in 24 seconds, native tests in 1 minute 17 seconds, AddressSanitizer in 1 minute 43 seconds, hosted Shell in 2 minutes 7 seconds, Docusaurus in 2 minutes 10 seconds, and exhaustive ARM packaging in 4 minutes 46 seconds; PR #630 merged by squash as 840d78a2e3f783e5d5d41e4020b2767e28ba9780",
+        "no deployment, update, reboot, Wi-Fi, listener, ROM, Save, input, overlay, or recovery-state mutation occurred for PR #630; older installed or rollback payloads may retain inherited bftpd bytes but current reconciliation remains fail-closed, and NET-10 still requires the coherent signed Full installation and rollback checkpoint before device completion can be claimed"
       ]
     },
     {