docs(poc): add PoC index and record PoC outcomes in CHANGELOG

Adds poc/README.md as the top-level index across all six PoC spikes,
recording status (5 PASS, 1 PARTIAL PASS), authority, and the
non-promotion rule from proof-of-concept-plan.md §4.

Updates CHANGELOG.md to enumerate the six spikes with their
verification dates and to reference each spike's VERIFICATION.md.

This completes Phase E of the post-bootstrap sequencing:
  E.1  git init + baseline import
  E.2  justfile
  E.3..E.8  six PoC spikes
  E.9  PoC index + CHANGELOG  ← this commit

poc/README.md

@@ -0,0 +1,42 @@
+# Chanora — Proofs of Concept
+
+This directory holds **non-product** technical spikes. They exist to retire
+risk before the Flutter/Rust product scaffold is created.
+
+Authority: [`docs/architecture/proof-of-concept-plan.md`](../docs/architecture/proof-of-concept-plan.md).
+
+> **Rule (PoC plan §4):** A PoC is not product code unless explicitly
+> promoted. Nothing here should be imported by the future
+> `apps/chanora_flutter` or `crates/chanora_*` trees.
+
+## Status
+
+| Spike | Required by PoC plan | Status |
+|---|---|---|
+| `tsclientlib-connect-spike` | yes | **PASS** — see `tsclientlib-connect-spike/VERIFICATION.md` |
+| `flutter_rust_bridge_hello` | yes (`flutter-rust-bridge-hello` in plan) | **PASS** — see `flutter_rust_bridge_hello/VERIFICATION.md` |
+| `secure-storage-spike` | yes | **PASS (Linux only)** — see `secure-storage-spike/VERIFICATION.md` |
+| `audio-capture-playback-spike` | yes | **PARTIAL PASS** — desktop verified, mobile not — see `audio-capture-playback-spike/VERIFICATION.md` |
+| `sqlite-storage-spike` | yes | **PASS** — see `sqlite-storage-spike/VERIFICATION.md` |
+| `diagnostics-redaction-spike` | yes | **PASS** — see `diagnostics-redaction-spike/VERIFICATION.md` |
+
+## Naming note
+
+`flutter_rust_bridge_hello` is listed in the PoC plan as
+`flutter-rust-bridge-hello`. The directory on disk uses underscores
+because the Dart `pubspec.yaml` package-name grammar forbids hyphens.
+This is a naming convention, not a scope change.
+
+## What "verified" means here
+
+Each verified spike contains:
+
+- a `README.md` describing scope, exit criterion, and reproduction;
+- a `VERIFICATION.md` recording the exact toolchain versions, command,
+  observed output, and an honest list of things the spike does **not**
+  validate.
+
+Spikes are intentionally narrow. They do not approximate Chanora
+architecture layering, they do not implement the documented DTO
+catalogue, and they do not stand in for the product Rust crates or
+Flutter modules.