docs: replace the two stale TODO files with one live list

`TODO-v0.7.5.md` held the live v0.7.7 section while `TODO-hardening.md` still
carried v0.6.0 and v0.7.0 planning. Both had become archaeological layers, and a
file named for an old release is actively misleading about which work is
current.

`TODO.md` is unversioned so it cannot rot the same way, and holds only open
work: in flight, ready to pick up, blocked and on whom, hardware verification,
and deferred. The two old files are deleted rather than archived — git has them,
and a stale checklist at the repo root is worse than no checklist.

Every item was checked against the repository rather than its checkbox, and 8
of the 34 marked open were already done — including the README and Learn-site
audit, the factory-reset and move-key hardware runs, and `molto slots` keeping
partial results on a mid-sweep failure.

The reverse error appeared twice. The largeBlob SSH-certificate helper and the
"master reset / key decommission" item were both marked deferred-and-not-in-this-
release, and both shipped — the second as this release's headline feature. One
item marked done was hiding live work: the security review is ticked, but its
body names two follow-ups deliberately left out of scope, which are now entries
of their own.

`packaging/README.md` pointed at the hardening file for the crates.io
first-publish order; that order is inlined there now rather than pointing at a
file that no longer exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SQv9x6xi3CxXs2PvXohaFu

Author: framefilter