docs(VeraCrypt): add TODO.md and surface the open defect in crossrepostatus - #30

Closes the gap left by #29: crossrepostatus.md listed VeraCrypt as a tracked repo but
carried no status for it, so an open, deliberately unfixed defect was invisible to
anyone reading only the index.

The problem

After #29 the reproduced RNG check-then-lock race was documented in
VeraCrypt/concurrency-findings.md — analysis, standalone reproducer, and a three-step
fix. But the index said only "build and coverage tooling, submitted PRs, local-only
findings". Nothing indicated that one of those findings is a live defect with a designed
but unapplied fix.

The new two-tier structure says single-repo open work belongs in each repo's own
TODO.md — and VeraCrypt had none.

What changed

VeraCrypt/TODO.md (new)

Groups the open items by what is actually blocking them, which is the useful axis here:

Two entries are deliberately phrased as do not do this, because both look like easy wins
and both are traps:

• EncryptionMode::ValidateParameters sits at 38.71 % and cannot be raised honestly —
  calling it from a test paints the line green while the real point (production never
  validates these parameters) stays untouched.
• ValidateState() is compiled out of Release. Testing it needs a DEBUG=1 build and
  proves nothing about the shipped binary.

Why the file is not in the VeraCrypt repo

The other tracked repos keep TODO.md in the repo itself. VeraCrypt cannot: the fork is
used to prepare upstream pull requests, and these items are a local record that must not
reach upstream. A TODO.md inside the working copy would sooner or later be swept into a
branch. The reason is stated in both crossrepostatus.md and the file itself, so the
deviation from the convention does not read as an oversight.

crossrepostatus.md

• VeraCrypt/TODO.md added to the single-repo-open-work list, with the note above
• the VeraCrypt entry now carries an actual status line: 4 PRs pending upstream, and one
  reproduced defect that is deliberately unfixed and unreported

VeraCrypt/README.md

TODO.md added to the contents table as the start here entry.

Verification

All relative links and both section anchors (#suggested-fix,
#weaknesses-that-remain) resolve against the files on main.

Scope

Documentation only. Branched off current main (dbe536d), no production code, no changes
to any sibling repo. Nothing here is reported upstream.

Assembled with the support of Anthropic Claude Opus.