docs: record the SonarCloud backlog and the What's cooking task

Two additions to Phase 3.

SonarCloud, with the breakdown rather than the headline: 51 open issues are 0
bugs, 0 vulnerabilities and 51 code smells, and 35 of those are hardcoded-URI
warnings against a deep-link mapper's test fixtures and a one-forge client's
endpoint constants. Those want triaging as Won't Fix, not refactoring. The part
worth real thought is the 3 hotspots — the sr.ht token is stored without a
SecAccessControl, so an unlocked phone hands it over, which is a product
decision rather than a lint nit.

Ingesting sr.ht's quarterly "What's cooking" posts, because nothing here tracks
the API's evolution and this repo's assumptions rot silently. Already proven
worthwhile: SCOPE.md claimed pronouns were not in the schema while AppState
queries them and UserProfileView displays them. That entry is struck through and
kept as evidence. Q2 2026 also reports a writable hub.sr.ht API and finished
deploy keys, both of which contradict what is written here.

1 files changed, 5 insertions, 1 deletions

diff --git a/SCOPE.md b/SCOPE.md
index 407f292..967ce44 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -5,7 +5,11 @@
 - Push notifications for builds and tickets (requires a backend relay server)
   - ref: https://git.sr.ht/~ccleberg/hutch-notify
 - Explore / search (hub.sr.ht) (no public discovery API)
-- Pronouns on profile (not in GraphQL schema)
+- ~~Pronouns on profile (not in GraphQL schema)~~ — **stale**. sr.ht added
+  pronouns (see the Q1 2026 "What's cooking"), and Hutch already queries them in
+  `AppState` and shows them in `UserProfileView`. Left here struck through as
+  evidence for the ingestion task in ROADMAP.md: this entry spent months telling
+  people not to build something that was already built.
 - Revoke personal access tokens (`@internal` in schema, inaccessible)
 - Archive a message to a list (`archiveMessage` is `@internal`, inaccessible)
 - Ticket activity feed (todo.sr.ht's root `events` query is broken upstream and