fix(ci): pin k6 to clear platform-perf-smoke tip red

[fraware]

Summary

• Pin K6_VERSION=0.47.0 in platform-perf-smoke.yml and slo-gates.yaml so CI does not call unauthenticated api.github.com/.../releases/latest (403 flakiness that red-gated tip after Prove MicroInterp DFA coupling and re-gate abandoned CI smokes #215).
• Refresh Wave 8 status in remediation tracker + wave7 runbook.

Context

After PR #215, inventory was 69 gated / 1 red: only platform-perf-smoke failed on k6 install. All eight Wave 8 revive workflows were already green.

Test plan

• PR CI: Platform Performance Smoke Tests green
• PR CI: SLO Gates green when triggered
• After merge: powershell -File scripts/ci_workflow_inventory.ps1 exit 0

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

[github-actions]

SBOM Security Report

Total Packages: 4528

Language Distribution:

• go: 359
• javascript: 3277
• rust: 592
• python: 1

License Distribution:

• MIT: 1270
• Apache-2.0: 45
• CC0-1.0: 43
• BSD-3-Clause: 34
• ISC: 87
• BSD-2-Clause: 41
• Python-2.0: 2
• MPL-2.0: 1
• Unlicense: 5
• CC-BY-4.0: 1
• (Apache-2.0 OR MPL-1.1): 1
• BlueOak-1.0.0: 3
• (AFL-2.1 OR BSD-3-Clause): 2
• (BSD-3-Clause OR GPL-2.0): 1
• 0BSD: 3
• (MIT OR CC0-1.0): 4
• MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found