docs(VeraCrypt): add TODO.md and surface the open defect in crossrepostatus

[bernardladenthin]

Closes the gap left by #29: crossrepostatus.md listed VeraCrypt as a tracked repo but
carried no status for it, so an open, deliberately unfixed defect was invisible to
anyone reading only the index.

The problem

After #29 the reproduced RNG check-then-lock race was documented in
VeraCrypt/concurrency-findings.md — analysis, standalone reproducer, and a three-step
fix. But the index said only "build and coverage tooling, submitted PRs, local-only
findings". Nothing indicated that one of those findings is a live defect with a designed
but unapplied fix.

The new two-tier structure says single-repo open work belongs in each repo's own
TODO.md — and VeraCrypt had none.

What changed

VeraCrypt/TODO.md (new)

Groups the open items by what is actually blocking them, which is the useful axis here:

Group	Contents
Waiting on upstream maintainers	4 PRs, incl. the #1844-before-#1850 merge-order constraint
Blocked on a decision, fix designed	the RNG race and the unjoined VolumeCreator thread
Robustness, no live defect	unguarded VolumeLayout header, dead ValidateParameters, if_debug in Release
Coverage gaps needing fixtures	Keyfile.cpp at 47 %, VolumeHeader.cpp decrypt loop
Known weakness in our own tests	the AddToPool guard is covered but not asserted

Two entries are deliberately phrased as do not do this, because both look like easy wins
and both are traps:

• EncryptionMode::ValidateParameters sits at 38.71 % and cannot be raised honestly —
  calling it from a test paints the line green while the real point (production never
  validates these parameters) stays untouched.
• ValidateState() is compiled out of Release. Testing it needs a DEBUG=1 build and
  proves nothing about the shipped binary.

Why the file is not in the VeraCrypt repo

The other tracked repos keep TODO.md in the repo itself. VeraCrypt cannot: the fork is
used to prepare upstream pull requests, and these items are a local record that must not
reach upstream. A TODO.md inside the working copy would sooner or later be swept into a
branch. The reason is stated in both crossrepostatus.md and the file itself, so the
deviation from the convention does not read as an oversight.

crossrepostatus.md

• VeraCrypt/TODO.md added to the single-repo-open-work list, with the note above
• the VeraCrypt entry now carries an actual status line: 4 PRs pending upstream, and one
  reproduced defect that is deliberately unfixed and unreported

VeraCrypt/README.md

TODO.md added to the contents table as the start here entry.

Verification

All relative links and both section anchors (#suggested-fix,
#weaknesses-that-remain) resolve against the files on main.

Scope

Documentation only. Branched off current main (dbe536d), no production code, no changes
to any sibling repo. Nothing here is reported upstream.

---

Assembled with the support of Anthropic Claude Opus.