docs(analysis): capture run blocker audit

[rochecompaan]

Summary

Capture the October 7, 2026 run blocker audit in docs/analysis/2026-10-07-run-blockers.md.

• Preserve the inventory counts, reason catalog, sample limits, and local evidence references.
• Separate historical failures from the small sample after the inline transition.
• Record five proposed workstreams, reuse existing Implementation cleanup blocks on ignored worktree content (regression of the #243 policy) #262, and preserve the decision that superseded Replace single-subagent implementation skill with oracle-adjudicated checkpointed workflow #265.
• Publish paraphrased evidence only. Keep raw Pi transcripts, session identities, full reason dumps, and CSV inventories local.

Related tracking issue: #293. This PR does not close it.

This is documentation only, not a spec or implementation plan. Approval of this report does not authorize its proposed production changes.

Verification

• Prettier passed for the report.
• Markdownlint passed across 254 Markdown files with zero errors.
• Direct checks matched both report tables and all CSV totals to the retained snapshot.
• All 108 recorded interruption reasons matched their cited source records. All 11 published source citations matched those inventory rows.
• Publication scans found no absolute home paths, session UUIDs, or common credential patterns. The staged diff contains only the report.

No new automated tests were added because this is a static documentation artifact. Formatting, inventory, source-reference, and publication-scope checks provide the relevant evidence. No source code, skill files, dependencies, saved run state, or live execution controls changed.

[rochecompaan]

CI note: the site job fails at npm --prefix site audit --audit-level=high, before the build. It reports 13 vulnerabilities: 11 moderate and two high. The high findings are sharp (GHSA-wq5f-xc86-pv6w) and source-map-js (GHSA-68fv-2mgg-jv7q).

Failure log: https://github.com/rochecompaan/patchmill/actions/runs/37586451166/job/112677571441

I reproduced the same totals and exit code 1 on the unchanged main checkout at 83846f0bcd0717e8c152da510bf6ed9255812bbc with:

npm --prefix site audit --audit-level=high --json

The main checkout remained clean. This PR changes only the audit report and does not change the site's dependency manifests or lockfile. This is an existing dependency-audit failure, not evidence that the report changed application behavior. The required CI gate remains failed. I did not weaken it or apply dependency fixes outside this documentation task.

This new CI observation occurred after the report's retained inventory snapshot. It is recorded here rather than added to the historical counts.