docs(poc): add PoC index and record PoC outcomes in CHANGELOG

Adds poc/README.md as the top-level index across all six PoC spikes,
recording status (5 PASS, 1 PARTIAL PASS), authority, and the
non-promotion rule from proof-of-concept-plan.md §4.

Updates CHANGELOG.md to enumerate the six spikes with their
verification dates and to reference each spike's VERIFICATION.md.

This completes Phase E of the post-bootstrap sequencing:
  E.1  git init + baseline import
  E.2  justfile
  E.3..E.8  six PoC spikes
  E.9  PoC index + CHANGELOG  ← this commit

CHANGELOG.md

@@ -10,6 +10,32 @@ This project is expected to follow a Conventional Commits style workflow.
 
 - Initial repository foundation files.
 - Documentation-first project structure.
+- `justfile` with `format`, `lint`, `test`, `verify-docs`, and
+  `security-scan` targets, completing `repository-bootstrap-plan` v0.1.0 §3.
+- `poc/tsclientlib-connect-spike/` — PoC proving protocol feasibility via
+  `tsclientlib`. Verified against `cn.teamspeak.app` on 2026-05-13.
+- `poc/flutter_rust_bridge_hello/` — PoC proving the Flutter↔Rust command
+  and event-stream boundary via `flutter_rust_bridge` 2.12.0. Verified on
+  Linux desktop on 2026-05-13.
+- `poc/secure-storage-spike/` — PoC proving platform secure storage via
+  a typed `SecretStorageRepository` trait and a Linux adapter selecting
+  between Secret Service (libsecret) and kernel keyutils. Audit checks
+  SS-AUD-001/002/003/005/006 and SS-TC-003 verified on 2026-05-13.
+- `poc/sqlite-storage-spike/` — PoC proving SRS-089's "embedded data
+  store + migration mechanism" acceptance criteria: forward-only schema
+  migrator tracked via `PRAGMA user_version`, repository pattern with
+  `BookmarkRepository` / `SettingsRepository` traits over
+  `LocalDatabaseRepository`. 11/11 tests verified on 2026-05-13.
+- `poc/diagnostics-redaction-spike/` — PoC proving the diagnostic
+  redaction policy from `diagnostic-redaction-audit-report.md`:
+  typed policy + regex rules + literal known-secret registry + bundle
+  redaction. Audit cases REDACT-TC-001..010 verified on 2026-05-13.
+- `poc/audio-capture-playback-spike/` — PoC proving platform audio
+  capture/playback via cpal. Desktop half (Linux + PipeWire)
+  empirically verified end-to-end on 2026-05-13; mobile half
+  (Android Oboe / iOS AVAudioEngine) documented as an open gap.
+- `poc/README.md` summarising PoC status against
+  `docs/architecture/proof-of-concept-plan.md`.
 
 ### Changed
 

poc/README.md

@@ -0,0 +1,42 @@
+# Chanora — Proofs of Concept
+
+This directory holds **non-product** technical spikes. They exist to retire
+risk before the Flutter/Rust product scaffold is created.
+
+Authority: [`docs/architecture/proof-of-concept-plan.md`](../docs/architecture/proof-of-concept-plan.md).
+
+> **Rule (PoC plan §4):** A PoC is not product code unless explicitly
+> promoted. Nothing here should be imported by the future
+> `apps/chanora_flutter` or `crates/chanora_*` trees.
+
+## Status
+
+| Spike | Required by PoC plan | Status |
+|---|---|---|
+| `tsclientlib-connect-spike` | yes | **PASS** — see `tsclientlib-connect-spike/VERIFICATION.md` |
+| `flutter_rust_bridge_hello` | yes (`flutter-rust-bridge-hello` in plan) | **PASS** — see `flutter_rust_bridge_hello/VERIFICATION.md` |
+| `secure-storage-spike` | yes | **PASS (Linux only)** — see `secure-storage-spike/VERIFICATION.md` |
+| `audio-capture-playback-spike` | yes | **PARTIAL PASS** — desktop verified, mobile not — see `audio-capture-playback-spike/VERIFICATION.md` |
+| `sqlite-storage-spike` | yes | **PASS** — see `sqlite-storage-spike/VERIFICATION.md` |
+| `diagnostics-redaction-spike` | yes | **PASS** — see `diagnostics-redaction-spike/VERIFICATION.md` |
+
+## Naming note
+
+`flutter_rust_bridge_hello` is listed in the PoC plan as
+`flutter-rust-bridge-hello`. The directory on disk uses underscores
+because the Dart `pubspec.yaml` package-name grammar forbids hyphens.
+This is a naming convention, not a scope change.
+
+## What "verified" means here
+
+Each verified spike contains:
+
+- a `README.md` describing scope, exit criterion, and reproduction;
+- a `VERIFICATION.md` recording the exact toolchain versions, command,
+  observed output, and an honest list of things the spike does **not**
+  validate.
+
+Spikes are intentionally narrow. They do not approximate Chanora
+architecture layering, they do not implement the documented DTO
+catalogue, and they do not stand in for the product Rust crates or
+Flutter modules.