docs: VeraCrypt knowledge base + widen crossrepostatus to all tracked repos

[bernardladenthin]

Adds a knowledge base for the VeraCrypt work and widens crossrepostatus.md so it
covers every tracked repository, not just the four Java siblings.

Why

The workspace was implicitly Java-only: crossrepostatus.md opened with "items that
span ≥ 2 of the four sibling repos", and every guide, policy and the java-tdd-guide
skill assumed Maven. VeraCrypt (C/C++) had nowhere to live, so a long session's findings
existed only in a chat transcript.

What changed

1. New VeraCrypt/ folder — 8 files, ~1030 lines

File	Topic
README.md	Entry point + the platform/source-file matrix
upstream-sync.md	The fork drifts silently — verify before analysing anything
build-verification.md	Linux (Docker) and Windows (native MSVC) builds
coverage-measurement.md	Why lcov/gcovr report wrong numbers here; use plain gcov
test-coverage-work.md	14 test blocks with detection proof — submitted as veracrypt/VeraCrypt#1850
concurrency-findings.md	Reproduced check-then-lock race in the RNG, with a standalone reproducer
code-findings.md	Dead code, if_debug in Release, uncovered-but-reachable paths
contributions.md	Submitted PRs, merged work, items deliberately left alone

The single most reusable fact recorded: different platforms compile different source
files. src/Common/ is not in the Linux PROJ_DIRS, and src/Volume/** appears in no
.vcxproj at all — so "where is this code used" has no single answer, and several
otherwise-sensible assumptions break on it.

2. Two-tier scope in crossrepostatus.md and CLAUDE.md

Rather than deleting the Java-only limitation, the repos are now split into a Java tier
(BAF, jllama, srcmorph, sb — governed by the guides, policies and the skill) and other
tracked repos (VeraCrypt, llama.cpp, subprocess.h — own conventions, own folder).

The parity tables compare Maven, PIT and SpotBugs, so they genuinely cannot have rows for
a C/C++ repo. The scope note now says so explicitly — a blank is a non-applicability
rather than a gap — otherwise every missing VeraCrypt row reads as an omission.

Factual statements in the body of crossrepostatus.md that say "all four repos" were left
alone; they are true statements about the Java repos and rewriting them would damage
correct history.

Merge resolution worth noting

main pruned crossrepostatus.md from 748 to 195 lines in 29afb8b while this branch was
open, which conflicted. Resolved by taking main's pruned version as the base and
reapplying the scope-widening edits on top — the prune is not reverted. Verified: the diff
against main contains no deletions.

Scope

Documentation only. No production code, no build system, no changes to any sibling repo.

The findings in concurrency-findings.md and code-findings.md are a local record and
were deliberately not reported upstream; the upstream PR (veracrypt/VeraCrypt#1850)
contains tests only.

---

Assembled with the support of Anthropic Claude Opus.