docs: record CSRG-U4 as merged

[novelKR]

Records CodeSpace's CSRG-U4 as merged-verified in DevGuard's ledger. It is bookkeeping, the same kind of change as #22, #25, #26 and #28, and is not part of U4's definition of done.

Why

CSRG-U4 merged in CodeSpace on 2026-10-09 as novelKR/CodeSpace#90, at its exact head c1c7859 on the owner's approval, as merge commit 3e5e3e8 (the head's tree). Every check on that head passed: CI run 37916045407, Rust / macOS contracts and Rust / Integration included, and documentation run 37916046001. The post-merge CI of main at 3e5e3e8 is green: CI run 37944159990, all 17 jobs, Rust / macOS contracts included, and documentation run 37944161211. #28 recorded U4 as active; the ledger still says so.

Changes

File	Change
milestones.json	CSRG-U4 is merged-verified, as #26 recorded U3. units.as_of is 2026-10-09. U5 and U6 stay not-started. CS-RG stays in-progress, qualification not-run
docs/milestones.md	The CS-RG row lists novelKR/CodeSpace#90 with the merged units, and the dated note under the suspension notice says U4 is merged and verified
AGENTS.md	The dated current-state note says U4 is merged
docs/planning/README.md, docs/ko/planning/README.md	The dated current-state note says U4 is merged
docs/planning/milestones/CS-RG.md, docs/ko/planning/milestones/CS-RG.md	The dated current-state note says U4 is merged and verified

Korean counterparts reviewed; planning-readme and planning-milestones-cs-rg hashes recorded with scripts/check_docs.py record.

What does not change

• CS-RG is not marked implemented or qualified, and U5 is not recorded as started: it waits for the owner's separate approval.
• The suspension of the CSRG-C00–C09 plan stays in force, and no historical text is rewritten: each change is the existing dated note or the living status row.
• No product code, contract, design revision, pin, dependency, CI policy or test changes. The DG-1 qualified release stays 0.1.0-5daee5d-b3fa569e; the owner chose to cut the next release just before CSRG-U6.

Verification

At 615186f, based on main at df3c537:

• python3 scripts/ci_plan.py --base origin/main --head HEAD: profile affected, 8 normative paths, stages whitespace, source-contract and documentation, no Rust.
• python3 scripts/validate.py --stages whitespace,source-contract,documentation --diff-base origin/main: all three passed.
• python3 scripts/check_docs.py: passed, 18 reviewed pairs, 48 work units, 25 logical PR groups.
• This PR's CI: run 37944903923, Repository checks and Required checks passed (contracts skipped: no contract paths).

Rollback

Revert the merge (git revert -m 1 <merge commit>). The ledger then reports U4 as active again, which would be inaccurate once U4 is merged.