docs(plan-c): mark Task 2 (universal commitSigned) DONE + security-clean

Universal isomorphic-git receive-pack push path shipped & verified: sshsig.ts +
mem-fs.ts + git-push.ts + commitSigned on GitHost/Gitea/GitHub. Full SW suite
163/163, build:all bundles isomorphic-git into the SW, /security-review clean.
Tasks 3-5 remain HELD on Dev-A + Dev-B merge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LKBbrAjmpVXMEK15pNi3Ha

docs/superpowers/plans/2026-06-20-v0.9.0-org-c-write.md

@@ -60,9 +60,11 @@ git commit -m "spike: org signed-commit push via host Git Data API — <GO|NO-GO
 
 ---
 
-### Task 2: universal `commitSigned` — isomorphic-git receive-pack push (RE-SCOPED 2026-06-25)
+### Task 2: universal `commitSigned` — isomorphic-git receive-pack push (✅ DONE 2026-06-26)
 
 > **A/B-INDEPENDENT — build now.** Replaces the original "Git Data API" Task 2 (dead on Gitea). ONE transport for both hosts, proven by the mini-spike.
+>
+> **DONE 2026-06-26** (commits `b3db292`, `273fe5c`, `0bc1f53`, `56dec78`, `d942650`). Shipped `sshsig.ts` (SSHSIG framing, golden-vector-gated) + `mem-fs.ts` (dep-free in-memory `PromiseFsClient`) + `git-push.ts` (isomorphic-git clone→commit{onSign}→`git-receive-pack` push) + `commitSigned` on `GitHost`/Gitea/GitHub. SDD per-task reviews clean (caught+fixed 1 Critical: hash exact payload view; 1 Important: real isomorphic-git `PushResult` shape + test the throw path). Full SW suite 163/163; `build:all` bundles isomorphic-git into the SW. **/security-review on the push path: NO qualifying findings.** Live residual (non-blocking): one real push to git.adlee.work/github to confirm per-host Basic-auth.
 
 **Files:**
 - Add dep: `isomorphic-git` (~68KB gzip, user-approved) in `extension/package.json`.