docs: update ROADMAP.md checkboxes and STATUS.md sprint state (closes #156, closes #158)

ROADMAP.md (#156):
- Phase 0: mark cluster audit done (issue #36 ✅)
- Phase 4: mark VIN Decoder metrics + Grafana dashboard done (issue #129 ✅)
- Phase 5: mark docs-site skeleton (#28 ✅), CI pipeline (#29 #38 #85 ✅),
  and SEO blog posts (#39 #124 ✅) as complete
- Phase 6: mark legal docs (ToS, Privacy Policy, AUP) done (#40 #89 ✅)

STATUS.md (#158):
- Update last-updated date to 2026-06-01
- Add Current Blockers section (as of 2026-06-01) with dependency-ordered P1 list
- Add Sprint Summary section: issues closed (#145-#154), opened (#150 #151 #156 #157 #158)
- Update VIN Decoder blockers: #129 marked closed, #126 added
- Add new Completed This Cycle entry for 2026-06-01

kustomize build flux/ = PASS

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-31 (sprint planning cycle)_
+_Last updated: 2026-06-01 (sprint triage cycle)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -23,6 +23,30 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Image automation:** `flux/image-automation/` — ImageRepository + ImagePolicy + ImageUpdateAutomation for all three APIs
 - **VIN Decoder manifests:** `flux/vin-decoder/` — Flux HelmRelease + Kustomization committed (issue #140)
 
+## Completed This Cycle (2026-06-01 — Sprint Triage)
+- **#158** — STATUS.md updated with 2026-06-01 current blockers and sprint summary.
+- **#156** — ROADMAP.md checkboxes updated: Phase 4 VIN Decoder metrics, Phase 5 docs-site/pipeline/blog, Phase 6 legal docs all checked off.
+- **`kustomize build flux/` = PASS** — no regressions.
+
+## Current Blockers (as of 2026-06-01)
+
+In dependency order — operator tasks unless noted:
+
+1. **P1 #47** — Create `0xWheatyz/api-company` upstream repo (operator) — **highest priority, unblocks everything**
+2. **P1 #76** — Create `gitea-leeworks-agents-token` secret in `flux-system` (operator)
+3. **P1 #77** — Create `gitea-runner-token` secret in `gitea-runner` namespace (operator)
+4. **P1 #79** — Create `gitea-registry` imagePullSecrets in all API namespaces (operator)
+5. **P1 #83** — Configure `GITEA_TOKEN` Actions secret in zip-enrichment, holidays, air-quality repos (operator)
+6. **P1 #120** — VIN Decoder data layer — SQLite cache seeded from NHTSA vPIC (**agent — actionable now, not blocked**)
+7. **P1 #121** — VIN Decoder Fastify server implementation (agent — depends on #120)
+8. **P1 #126** — Configure `GITEA_TOKEN` Actions secret in vin-decoder repo (operator — depends on #122 ✅)
+9. **P1 #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace (operator)
+
+## Sprint Summary (2026-06-01)
+- **Issues closed since last STATUS update (#146):** #145–#154 — VIN Decoder sprint docs + infra (✅ all closed)
+- **Issues opened this sprint:** #150 (vin DNS reminder), #151 (VIN Decoder RapidAPI tiers), #155 (if applicable), #156 (ROADMAP.md update), #157 (full-stack validation), #158 (STATUS.md update)
+- **Top actionable agent task:** VIN Decoder code work — #120 (data layer) then #121 (Fastify server)
+
 ## Completed This Cycle (2026-05-31 — Sprint Cycle)
 - **#146** — STATUS.md updated to reflect VIN Decoder sprint wave (#117–#141): APIs table row added, completed wave documented, blockers updated.
 - **#145** — ROADMAP.md updated to reference VIN Decoder as 4th API across all phases (Phase 1–6). `kustomize build flux/` = PASS.
@@ -48,6 +72,8 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **#141** — Pricing page updated for VIN Decoder — **closed ✅** (PR #144 merged)
 
 ## Critical Path (operator must complete in order)
+See **Current Blockers** section above for the full ordered list as of 2026-06-01.
+
 1. **Create `0xWheatyz/api-company` repo** (#47) — **highest priority, unblocks everything**
 2. **Add api-company Flux source to Talos** (#90) — needs Talos PR, reference manifests at `flux/api-company-source/`
 3. **Create `gitea-leeworks-agents-token` secret** in `flux-system` (#76)
@@ -56,11 +82,12 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 6. **All other secrets** (#70, #73, #74, #79, #80, #81, #83) follow in order
 
 ## Blockers — VIN Decoder critical path
-- **P1: #120** — VIN Decoder data layer (NHTSA vPIC SQLite cache) — agent work pending
+- **P1: #120** — VIN Decoder data layer (NHTSA vPIC SQLite cache) — **agent work, actionable now**
 - **P1: #121** — VIN Decoder Fastify server — agent work pending, depends on #120
 - **P1: #127** — Create `gitea-registry` imagePullSecret in `vin-decoder` namespace — operator manual task
+- **P2: #126** — Configure `GITEA_TOKEN` secret in `vin-decoder` repo — operator manual task
 - **P2: #128** — Create `rapidapi-proxy-secret` in `vin-decoder` namespace — operator manual task
-- **P2: #129** — VIN Decoder Prometheus metrics instrumentation — agent work pending, depends on #121
+- ~~**P2: #129** — VIN Decoder Prometheus metrics instrumentation~~ — **closed ✅** (PR merged)
 - **P3: #139** — Add RAPIDAPI_VIN_* Actions secrets — operator task, depends on RapidAPI listing (#131)
 
 ## New Issues This Sprint (2026-05-30, #120–#146)