Complete RC6 supply chain gate

docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md

@@ -149,8 +149,8 @@ editions and licences must still pass source-specific probes before activation.
 | RC-3 | complete | temporal detection/QA correctness and observability |
 | RC-4 | complete | national/maritime scope and provider coverage contracts |
 | RC-5 | complete | deployment, secrets, configuration, fresh install and rollback |
-| RC-6 | in progress | complete CI, dependency and supply-chain gates |
-| RC-7 | pending | critical API envelope typing and contract validation |
+| RC-6 | complete | complete CI, dependency and supply-chain gates |
+| RC-7 | in progress | critical API envelope typing and contract validation |
 | RC-8 | pending | frontend and browser E2E release journeys |
 | RC-9 | pending | loading, accessibility and performance hardening |
 | RC-10 | pending | retention, cleanup and national data operations |
@@ -376,6 +376,17 @@ are aligned, and all operator-owned settings are editable in Unraid.
 
 ## RC-6 - CI and supply-chain gates
 
+**State: complete.** Equivalent Gitea and GitHub workflows now enforce the
+complete readiness gate, offline migrations, Compose resolution, dependency
+audits, immutable container build, SPDX SBOM and Trivy policy. Linux/Python
+3.11 runtime and CI locks are hash-pinned and optional AI dependencies remain
+separate. The live AI image passed the container policy with zero reachable
+fixed HIGH/CRITICAL findings; its complete report and 25.7 MB SBOM are retained
+on Tower. The report deliberately preserves two timeboxed Starlette findings
+and fifteen shadowed base-layer `gosu` findings. Runtime evidence proves that
+the final `gosu` path is the audited `setpriv` wrapper running as PostgreSQL
+UID 999.
+
 ### Work
 
 - make CI run backend compile/tests, frontend typecheck/build, readiness,