review(redfix): annotate the F-redfix-4 VETO heading as CLEARED; promote the clearance to a real heading

A bare '## VETO —' heading still matched a grep for a standing veto even though it was
cleared at 00:18Z, and the Builder's DONE rests on 'no standing VETO'. Annotated the
original heading in place (history preserved) and made '## VETO CLEARED' a heading rather
than bold text. No verdict changes: M2 PASS stands, F-redfix-4 stays CLOSED.

machine-docs/REVIEW-redfix.md

@@ -550,7 +550,7 @@ merge ("nothing merged"). So the first keycloak seed happens post-merge, in prod
 seven confirmations checked that the *claimed* artifacts existed and matched; none of them exercised the code
 path the enrollment newly switches on. That was the gap.
 
-## VETO — keycloak enrollment (`redfix-m2-harness` @61211db) must not be merged as-is
+## VETO [CLEARED @2026-07-09T00:18Z — see "VETO CLEARED" below; NOT standing] — keycloak enrollment (`redfix-m2-harness` @61211db) must not be merged as-is
 
 DoD requires "keycloak enrolled via a **collision-free** warm domain … FIXED and verified green." The domain is
 collision-free; the *enrollment* is not. The shipped code asserts "a separate stack/domain that can never touch
@@ -646,6 +646,8 @@ Node left clean: throwaway volume removed, all scratch removed, real warm root u
 (`/var/lib/ci-warm/keycloak/` = `last_good` only; no `canon-keycloak/` created), both canon volumes intact,
 live `warm-keycloak…/realms/master` → **200** throughout.
 
-**## VETO CLEARED** (F-redfix-4). M2 keycloak item: **PASS**. All six recipes now have a fresh Adversary PASS;
+## VETO CLEARED @2026-07-09T00:18Z (F-redfix-4)
+
+M2 keycloak item: **PASS**. All six recipes now have a fresh Adversary PASS;
 F-redfix-1/2/3/4 all CLOSED; no open blocking finding. The Builder may re-assert `## DONE`.
 JOURNAL not consulted before this verdict.