docs: correct reachability (Go ships) + close out C4 re-evaluation

[haksungjang]

Summary

Two things, folded together because the second surfaced the first.

1. Fixes a real accuracy defect: the docs understated shipped reachability

Several docs claimed reachability is "planned / not shipped / the backend does not run govulncheck." That is false. Go reachability ships and is fully wired + tested (tasks/scan_reachability.py runs govulncheck — built into the worker image — as a best-effort follow-up after every source scan, default-on REACHABILITY_ENABLED; it stamps each Go finding reachable / not-reachable / not-analysed, surfaced by the badge, the ?reachable= filter, and sort=reachable, and can feed the policy gate; tests: test_scan_reachability, test_govulncheck, test_vulnerability_reachability, test_policy_gate_reachability, ReachabilityBadge.test).

Corrected across reference/analysis-types.md (my Wave 7 page — the most wrong), comparison.md, and reference/data-sources.md (EN + KO mirrors): reachability ships for Go; other ecosystems (Java/JS/Python/…) are not yet analysed — and that multi-language gap is the real commercial differentiator, stated as such.

2. Records the C4 (multi-language reachability) re-evaluation

Investigating BomLens (now v1.8.2) for the C4 collaboration track found its premise is dead: BomLens explicitly classifies reachability as "the portal's domain" (bomlens-internal/improvement-roadmap.md) and won't change its stateless-local-tool identity — so "BomLens produces call-graph → TRUSCA ingests" cannot happen. Since TRUSCA already ships Go reachability, C4 is reframed to "TRUSCA-owned multi-language reachability" and deferred (no offline OSS call-graph tooling exists for Java/JS — the commercial moat). docs/completeness-master-plan.md §6 and docs/bomlens-parity-review.md updated (parity baseline bumped to v1.8.2+25, 8th review recorded).

Also from the parity review: version currency/staleness (behind-latest-patch / releases-behind — distinct from EOL) is adopted as parity #18 and queued for implementation; the regulatory-crosswalk and copyleft-strength items are recorded as low-value defers.

Verification

• docs-site build green for both EN and KO locales; no broken links/anchors (#reachability-detail preserved)
• ko-style 0 findings on the 3 corrected KO files
• docs-uat extract --lint OK (the reachability marker id was renamed planned→go in both locales; manifest is gitignored/regenerated)

CI note

Touches docs-site/** (not paths-ignored), so the code checks run and this merges normally; the docs/** roadmap updates ride along.