fix(web): add IwoooS evidence unlock queue

docs/LOGBOOK.md

@@ -1,3 +1,22 @@
+## 2026-06-01｜IwoooS 證據解鎖工作佇列
+
+**背景**：
+
+- IwoooS 首屏已補上進度證據流速儀，但仍需要把「下一批可以讓 61% 往前的具體工作包」轉成更像資安營運產品的可掃描佇列。
+- 本輪維持低摩擦策略：只做可視化、只讀證據語義與防退化，不新增執行按鈕或任何主機、版本來源變更。
+
+**本次調整**：
+
+- `apps/web/src/app/[locale]/iwooos/page.tsx`：新增 `IwoooSEvidenceUnlockQueueBoard`，在首屏列出 S4.9-S4.12 四個實證工作包：Gitea 負責人覆核、GitHub 目標來源確認、分支與標籤事實、工作流程與機密名稱。
+- `apps/web/messages/zh-TW.json` / `en.json`：新增證據解鎖工作佇列繁中文案；英文語系維持繁中鏡像。
+- `docs/security/iwooos-posture-projection.snapshot.json`：新增 `evidence_unlock_queue_items` 與 summary 計數，固定 request sent / received / accepted / runtime gate 仍為 `0`。
+- `scripts/security/security-mirror-progress-guard.py`：新增 S2.158 guard，鎖住工作佇列 testid、首屏順序、四包 gate 與 `action_buttons_allowed=false` 邊界。
+- `docs/security/security-mirror-status-rollup.snapshot.json`：新增 `s2_158_iwooos_evidence_unlock_queue` 進度台帳。
+
+**進度邊界**：
+
+- 整體維持 `61%`；本輪不是請求送出、審批建立、Kali SSH、掃描、主機更新、修復、部署、GitHub primary 切換或 Gitea 停用。
+
 ## 2026-06-01｜IwoooS 進度證據流速儀
 
 **背景**：

docs/security/iwooos-posture-projection.snapshot.json

@@ -52,6 +52,13 @@
     "progress_evidence_rail_review_acceptance_count": 0,
     "progress_evidence_rail_github_primary_ready_count": 0,
     "progress_evidence_rail_runtime_gate_count": 0,
+    "evidence_unlock_queue_first_layer": true,
+    "evidence_unlock_queue_item_count": 4,
+    "evidence_unlock_queue_request_sent_count": 0,
+    "evidence_unlock_queue_received_count": 0,
+    "evidence_unlock_queue_accepted_count": 0,
+    "evidence_unlock_queue_github_primary_ready_count": 0,
+    "evidence_unlock_queue_runtime_gate_count": 0,
     "visual_command_dashboard_widget_count": 14,
     "visual_command_dashboard_first_layer": true,
     "visual_command_dashboard_default_visible": false,
@@ -416,6 +423,69 @@
       "not_authorization": true
     }
   ],
+  "evidence_unlock_queue_items": [
+    {
+      "item_id": "giteaOwner",
+      "display_order": 1,
+      "gate": "S4.9",
+      "display_mode": "first_screen_evidence_unlock_queue",
+      "value": "0/5",
+      "request_sent_count": 0,
+      "received_count": 0,
+      "accepted_count": 0,
+      "runtime_gate_count": 0,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "item_id": "githubTarget",
+      "display_order": 2,
+      "gate": "S4.10",
+      "display_mode": "first_screen_evidence_unlock_queue",
+      "value": "0/8",
+      "candidate_repo_count": 8,
+      "github_primary_ready_count": 0,
+      "request_sent_count": 0,
+      "received_count": 0,
+      "accepted_count": 0,
+      "source_control_mutation_authorized": false,
+      "runtime_gate_count": 0,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "item_id": "refTruth",
+      "display_order": 3,
+      "gate": "S4.11",
+      "display_mode": "first_screen_evidence_unlock_queue",
+      "value": "0/5",
+      "request_sent_count": 0,
+      "received_count": 0,
+      "accepted_count": 0,
+      "refs_sync_authorized": false,
+      "runtime_gate_count": 0,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "item_id": "workflowSecrets",
+      "display_order": 4,
+      "gate": "S4.12",
+      "display_mode": "first_screen_evidence_unlock_queue",
+      "value": "0/5",
+      "request_sent_count": 0,
+      "received_count": 0,
+      "accepted_count": 0,
+      "secret_plaintext_collection_allowed": false,
+      "runtime_gate_count": 0,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    }
+  ],
   "first_progress_unlock_path_steps": [
     {
       "step_id": "owner_response_scope",

docs/security/security-mirror-status-rollup.snapshot.json

@@ -2365,6 +2365,18 @@
       "runtime_delta": false,
       "execution_authorized": false,
       "not_authorization": true
+    },
+    {
+      "delta_id": "s2_158_iwooos_evidence_unlock_queue",
+      "display_order": 187,
+      "completed_stage": "S2.158 IwoooS 證據解鎖工作佇列",
+      "progress_axis": "framework_detail",
+      "headline_percent_delta": 0,
+      "framework_delta_visible": true,
+      "why_headline_unchanged": "IwoooS 只新增首屏證據解鎖工作佇列，把 S4.9-S4.12 四包待補實證拆成 Gitea 負責人覆核 0/5、GitHub 目標來源確認 0/8、分支與標籤事實 0/5、工作流程與機密名稱 0/5；iwooos_evidence_unlock_queue_request_sent_count=0、iwooos_evidence_unlock_queue_received_count=0、iwooos_evidence_unlock_queue_accepted_count=0、iwooos_evidence_unlock_queue_github_primary_ready_count=0、iwooos_evidence_unlock_queue_runtime_gate_count=0、runtime_execution_authorized=false、active_runtime_gate_count=0、action_buttons_allowed=false，不把工作佇列當請求送出、審批建立、掃描、修復、部署、主機更新、版本來源切換、GitHub primary 切換或 Gitea 停用。",
+      "runtime_delta": false,
+      "execution_authorized": false,
+      "not_authorization": true
     }
   ],
   "next_safe_actions": [