docs: make README accurate for v0.10.0; sync verifications.c to reality

README badge + accuracy pass:
- Add a "11 root-verified out-of-band" badge; the dynamic release badge now
  shows v0.10.0.
- Reflect the exploit-verification milestone: 11 modules confirmed landing uid=0
  out-of-band, four false-EXPLOIT_OK bugs fixed.
- Correct stale counts against the runtime's own generated footer:
    * empirically-verified 29 -> 31 (dirty_cow + sudo_host graduated this
      release; refluxfs's record was also missing from the binary)
    * not-yet-verified 12 -> 10
    * test harness 88 -> 148 (33 kernel_range + 115 detect)
    * KEV "13 of 40" -> "13 of 41" (matches docs/KEV_CROSSREF.md)
- Move sudo_samedit from the 🟡 opt-in-full-chain list to 🟢 lands-root
  (16 full-chain), since it now roots directly.

core/verifications.c: add the three real records the binary was missing
(refluxfs on Rocky 9.8, dirty_cow on mainline 4.8.0, sudo_host on Ubuntu
22.04). `skeletonkey --list` now reports "31 empirically verified", matching
the README. Build + unit harness green (33 + 115).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

core/verifications.c

@@ -296,6 +296,36 @@ const struct verification_record verifications[] = {
         .actual_detect = "VULNERABLE",
         .status        = "match",
     },
+    {
+        .module        = "refluxfs",
+        .verified_at   = "2026-07-23",
+        .host_kernel   = "5.14.0-687.10.1.el9_8.0.1.x86_64",
+        .host_distro   = "Rocky Linux 9.8 (Blue Onyx)",
+        .vm_box        = "rockylinux/9",
+        .expect_detect = "VULNERABLE",
+        .actual_detect = "VULNERABLE",
+        .status        = "match",
+    },
+    {
+        .module        = "dirty_cow",
+        .verified_at   = "2026-07-24",
+        .host_kernel   = "4.8.0-040800-generic",
+        .host_distro   = "Ubuntu 16.04.7 LTS",
+        .vm_box        = "ubuntu/xenial64+mainline-4.8.0",
+        .expect_detect = "VULNERABLE",
+        .actual_detect = "VULNERABLE",
+        .status        = "match",
+    },
+    {
+        .module        = "sudo_host",
+        .verified_at   = "2026-07-24",
+        .host_kernel   = "5.15.0-25-generic",
+        .host_distro   = "Ubuntu 22.04 LTS",
+        .vm_box        = "generic/ubuntu2204",
+        .expect_detect = "VULNERABLE",
+        .actual_detect = "VULNERABLE",
+        .status        = "match",
+    },
 };
 
 const size_t verifications_count =