status(redfix): account for A-redfix-1/2/3 in the DONE block — none blocking, A-2/A-3 accepted

The DONE block listed F-redfix-1/2/3/4 as CLOSED but never mentioned the three
A-redfix-* findings, leaving them dangling for an operator reading only DONE.
All three are non-VETO and outside the DoD (Adversary wake #43, 1057657).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TkHo7RixQswYvvNnEcNaqW

machine-docs/STATUS-redfix.md

@@ -19,6 +19,17 @@ there is **no standing VETO**:
 
 Adversary findings F-redfix-1/2/3/4 are all **CLOSED**; no open blocking finding.
 
+The three `A-redfix-*` findings are also non-blocking and are accounted for here, so nothing dangles:
+- **A-redfix-1** (`/etc/cc-ci/.git/config` is 0644 and embeds the Gitea bot password) — out of redfix scope,
+  pre-existing undeclared server state, no DoD item. Mirrors my B-redfix-7. Not created by this phase.
+- **A-redfix-2** (the B-redfix-5 wedge's self-heal mechanism) — **ACCEPTED**; the mechanism and remediation
+  sentences in the B-redfix-5 precondition below are corrected. The precondition itself is unchanged.
+- **A-redfix-3** (the `main.go` "both clones" evidence) — **ACCEPTED**; that evidence is retracted below.
+  `/srv/cc-ci` is a symlink to `/srv/cc-ci-orch`. The file's origin remains unexplained; risk inert.
+
+A-redfix-2/3 corrected operator-facing *descriptions*, not DoD items; the Adversary confirmed no VETO at
+wake #43 (`b358b7e`, 2026-07-09T08:31Z).
+
 ## ⚠ OPERATOR ACTION REQUIRED — B-redfix-8 (HIGH, open, outside DoD)
 
 Phase DoD is met, but **one HIGH item is open and only an operator can close it.** It does not block `##