analysis: complete the systematic claim verification; add F-017 and ADR-0010 draft

verify_claims.py gives all 813 claim rows a mechanical disposition;
the 28 flags were adjudicated by hand (REPORT.md appendix). Two survived
as genuine drift (F-017): a closed issue still described as open in
shared/lab-netzwerk.md, and a 'pending' decision block in hosts/cfgmon.md
whose premise the same file records as executed.

Also: narrow the vendored-path filter (it silently dropped 7 tracked
icon files and produced false path-miss flags), record the confirmed
canonical author identity in F-003, verify the Gitea#48->GitLab#46
numbering shift by title in F-005, and add the ADR-0010 draft under
analysis/drafts/ for the human to git-mv into decisions/.

Branch renamed to Neckbeard-v0.1.1-analyse-1 per the human.

analysis/scripts/common.py

@@ -40,8 +40,12 @@ COMPONENTS = [
 OUT_OF_SCOPE_PROJECTS = ["game-operating", "gameserver"]
 OUT_OF_SCOPE_SUBGROUPS = ["vendor", "Archiv"]
 
-# Tracked-but-vendored paths, excluded from trees and scans.
-VENDORED = re.compile(r"(^|/)(node_modules|dist|build|\.yarn|vendor)/")
+# Tracked-but-vendored paths, excluded from trees and scans. Deliberately
+# narrow: an earlier broader pattern also excluded build/ and dist/, which
+# silently dropped 7 tracked files -- ThreadNet-Web keeps its desktop icons
+# under apps/desktop/build/, tracked source assets, not build output. That
+# made this analysis flag documented icon paths as missing.
+VENDORED = re.compile(r"(^|/)(node_modules|\.yarn)/")
 
 DOC_SUFFIXES = {".md", ".rst"}