docs: mark SEC_REVIEW F64 as fixed by F22

F64 noted that `compose.scheduler.yml` bind-mounted
`./docker/scheduler.crontab` from a path that didn't exist in the
repository — the scheduler container would start with an empty
`/etc/crontabs/root`, so `cleanup-audit` and
`cleanup-expired-manual-blocks` would silently never run.

The F22 fix (the scheduler image rebuild that replaced the runtime
`alpine:3` + `apk add` with a digest-pinned Dockerfile) already
resolved this as a side-effect. The bind-mount is gone; the
crontab now lives at `scheduler/scheduler.crontab` and is COPYed
into the image at build time:

    # scheduler/Dockerfile
    COPY scheduler.crontab /etc/crontabs/root

The schedule is now part of the immutable artifact rather than
depending on a host file. Operators wanting a different cadence
can still bind-mount their own crontab over `/etc/crontabs/root`
in compose — but the default no longer fails open.

Closing F64 for bookkeeping; no new code change required.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

doc/SEC_REVIEW.md

@@ -11,7 +11,7 @@
 >
 > Each finding is referenced as **F<N>** for later citation.
 >
-> **Findings rolled up:** 5 sev-3 (5 fixed, 0 open), 27 sev-2 (27 fixed, 0 open), 42 sev-1 (31 fixed, 11 open).
+> **Findings rolled up:** 5 sev-3 (5 fixed, 0 open), 27 sev-2 (27 fixed, 0 open), 42 sev-1 (32 fixed, 10 open).
 
 ---
 
@@ -2062,6 +2062,16 @@
   runs `cleanup-audit` (audit retention silently broken) or
   `cleanup-expired-manual-blocks`. Failure-open monitoring gap.
 - **Severity: 1**
+- **Status:** Fixed by the F22 fix (the scheduler-image rebuild that
+  replaced the runtime `apk add` with a pinned-digest Dockerfile).
+  The bind-mount of `./docker/scheduler.crontab` is gone;
+  `scheduler/scheduler.crontab` is `COPY`ed into the image at build
+  time so the schedule is part of the immutable artifact (`COPY
+  scheduler.crontab /etc/crontabs/root` in `scheduler/Dockerfile`).
+  Operators wanting a different cadence can still bind-mount their
+  own crontab over `/etc/crontabs/root` in compose, but the default
+  no longer depends on a host file at all. Closing F64 for
+  bookkeeping; no new code change required.
 
 ### F65 — `SecretScrubbingProcessor` does not match raw JWT shape
 - **Files:** `api/src/Infrastructure/Logging/SecretScrubbingProcessor.php:42-57`,