docs(P08): post-ship traceability + roadmap update (v1.1.3)

---ci---
project: acdl
phase: 8
milestone: v1.1
status: shipped
requirements:
  complete: [REQ-23]
release:
  tag: v1.1.3
---/ci---

ROADMAP Phase 08 -> complete (v1.1.3). REQUIREMENTS REQ-23 -> complete.
S3 state bucket + DynamoDB outbox table + IAM user acdl-spike-runner
with least-privilege scoped policy + rotated spike key all created and
verified. D-034 closure: user must manually rotate the root key now.

.ciagent/REQUIREMENTS.md

@@ -121,7 +121,7 @@
 | REQ-20 | 07 | complete (v1.1.2) |
 | REQ-21 | 07 | complete (v1.1.2) |
 | REQ-22 | 07 | complete (v1.1.2) |
-| REQ-23 | 08 | pending |
+| REQ-23 | 08 | complete (v1.1.3) |
 | REQ-24 | 09 | pending |
 | REQ-25 | 10 | pending |
 | REQ-26 | 09 | pending |

.ciagent/ROADMAP.md

@@ -100,7 +100,7 @@ milestone COMPLETE: `v1.2.0` (feature milestone, next minor per ship.md).
 
 ### Phase 08 — aws-oidc-bootstrap
 - **Description:** **Re-scoped per RESEARCH TARGET 1 + D-039.** Gitea Actions does not support `id-token: write` (conf 0.95), so real OIDC is deferred to v1.2. This phase instead: uses the temporary long-lived key (waiver D-034) once to create an S3 state bucket, a DynamoDB lock/outbox table, and an IAM user with a minimal scoped policy (S3 + DynamoDB + plan-only); stores the key as a Gitea Actions secret; implements `scripts/rotate_spike_key.sh` to rotate the key after each spike run. Real OIDC federation is tracked via go-gitea/gitea#36988 for v1.2.
-- **Status:** pending
+- **Status:** complete (v1.1.3)
 - **Depends on:** [07]
 - **Requirements:** REQ-23 (re-interpreted: AWS auth bootstrap + state backend; OIDC deferred to v1.2 per D-039)
 - **Success Criteria:**