Fix doc drift; document no-enforce-mode and universal publish

Corrections surfaced by doc-auditor + start9-spec-checker:
- testing.md: api suite 47 -> 54
- payments.md: FK enforcement confirmed at db/mod.rs:29
- startos-packaging.md: publish.sh now ships a universal s9pk
- licensing-tiers.md: record enforce-mode retirement and Creator caps
Refresh Current state for the StartOS submission-blocker work.

docs/guides/startos-packaging.md

@@ -38,7 +38,7 @@ silently no-ops an install whose version equals what's already installed. Run
 ## Release (operator-local scripts, in `~/.keysat/`, gitignored)
 
 ```
-~/.keysat/publish.sh                       # version-gate → make x86 → FileBrowser upload → registry register → GitHub mirror
+~/.keysat/publish.sh                       # version-gate → make universal → FileBrowser upload → registry register → GitHub mirror
 ~/.keysat/deploy-sites.sh landing docs     # push static sites; accepts: landing | docs | registry-landing
 ```
 
@@ -49,10 +49,13 @@ Credentials: `~/.keysat/filebrowser.env` (`chmod 600`); env `KEYSAT_FB_USER`,
 
 ## Arch & manifest
 
-- Both `x86_64` and `aarch64` build cleanly (arm verified 2026-06-12). The
-  manifest declares `['x86_64', 'aarch64']` but `publish.sh` only uploads x86_64 —
-  **don't claim multi-arch as shipped** until publish handles both. (`riscv` target
-  exists, unverified.)
+- Both `x86_64` and `aarch64` build cleanly (arm verified 2026-06-12). `publish.sh`
+  now builds a single universal `keysat.s9pk` via `make universal` (both arches in
+  one package — the registry holds one s9pk per version, so a per-arch split won't
+  work), matching the manifest's `['x86_64', 'aarch64']` claim. **Pending a
+  verification build**: the combined universal pack hasn't been run end-to-end yet;
+  confirm the registry index lists both arches on the first publish. (`riscv` target
+  exists, unverified; not in the manifest, so `make universal` excludes it.)
 - Manifest `license` is `LicenseRef-Keysat-1.0`, matching the package-root
   `LICENSE` SPDX id.