docs(steering): sync steering + xce-audit-invariants skill after Jul 13-18 work

- ha-async-io.md: document the same-batch endpoint lifetime hazard
  (bug-1447) and its ref-whole-batch-before-dispatch fix pattern
- xce-audit-invariants SKILL.md: add object-lifetime-within-a-dispatch-batch
  as a 6th audit dimension, so a future pass checks other batch loops
  (vtaskmgr drain, peer-list iteration) for the same shape
- product.md: replace the stale "HA consistency family is the current
  focus" framing with the actual 2026-07-18 status (umbrella complete,
  9-spec validate-impl batch closed, job-array-single-wal-record shipped)
- roadmap.md: correct 5 entries that were stale relative to actual spec
  status (ha-consistency-invariants/ha-wal-replication/libxce-failover
  pulled out of "In Flight", ha-term-safety and raft-drive-async marked
  implemented+GO, raft-sim-conformance and job-array-single-wal-record
  given closure annotations) -- struck through, not deleted, per this
  file's own additive-update convention
- testing.md: document that meson's aggregate Fail:0 can mask Unity
  sub-group failures -- always check the standalone binary's own summary
- src/controller/CLAUDE.md: fix a stale line-citation for the votedFor
  atomicity invariant (had drifted onto unrelated post-election code)

.claude/skills/xce-audit-invariants/SKILL.md

@@ -66,6 +66,16 @@ have historically found real violations are:
    any ingest path (standby WAL receipt, catch-up, heartbeat)?
 5. **Error handling** — silent swallowed errors, missing `ReturnError`, or a
    fail-open where the invariant docs require fail-loud-and-fence.
+6. **Object lifetime within a dispatch batch** (new 2026-07-18, bug-1447) —
+   any loop that processes a batch of items fetched in one call (epoll
+   `events[]`, a vtask drain, a peer-list scan) where one item's handler can
+   free/unref an object that a LATER item in the SAME batch still references.
+   `iomgr_unmonitor()`/`endpoint_unref()` only affects *future* dispatch, not
+   an event already sitting in the current batch array — see `ha-async-io.md`
+   "Same-batch endpoint lifetime" for the reference shape (`io_worker_dispatch_batch`'s
+   ref-whole-batch-before-dispatch fix). Check other batch-processing loops
+   (vtaskmgr's drain, any peer-list iteration that can trigger eviction) for
+   the same shape, not just `io_worker`.
 
 Each subagent must report file:line evidence for every claimed violation —
 no speculative findings. Use the Agent tool directly (general-purpose or