[Maurice1969DB]

Notes only: adds notes/step-77-spec-029-am1-and-a-policy-gap.md and its row in the NOTES.md index, plus a reference under "Service hardening".

It records what #204 settled and what it found along the way:

• Why the amendment. c2pa-rs 0.90 signs a manifest without an actions assertion that every verifier reads as Invalid. 0.91 refuses it after signing, and the service answered 500. The service now refuses such a request itself, with a 400.
• The gap in REQUIRE_AI_MARKING. A body without the extra_assertions key was signed with no AI marking, because rejectAssertions() returned early. The early return and the policy check arrived in the same commit (6445e2d), so the gap was as old as the policy. The note covers why no test or criterion saw it, and how writing AC12 surfaced it.
• What was verified and what was not. The note says plainly that a 0.91 build answering 400 rather than 500 is reasoned, not measured.

composer check 528 passed / 7 skipped; bin/spec-check.php 0 errors.