docs(security): complete SECURITY-169 merge SHAs

[fermatmind]

What changed

• Backfill the eight missing implementation merge SHAs in SECURITY-169 API12-16 and API36-38 ledger entries.

Why

• Make the final API01-40 audit ledger complete and machine-verifiable.

Validation

• python3 -m json.tool docs/codex/pr-train-state.json >/dev/null
• Asserted all SECURITY-169-API-01 through API40 entries are merged and contain commit_sha, merged_at, and pr_url.
• git diff --check
• Ledger-only scope validation: exactly docs/codex/pr-train-state.json.

Deferred items

• Existing sidecar issues remain unchanged.
• No staging wait, manual deploy, production deploy, CMS write, or production import.