Repoint the TODO.md citations that no longer resolve

Its own SS0-SS9 structure survived the move to the tracker, so 133 citations
still resolve and are left alone. Thirteen did not.

Six named another repository's TODO.md by a section number: libakstdlib 1.6,
2.2.2 and 2.3, and libakgl's file. Those repositories dropped their numbering
entirely, so each now names UPGRADING.md, an issue, or the tracker.

Three cited 'TODO.md section 12', which has never existed here -- the defect
list is SS6. TODO.md itself caught two others of that class earlier. The
CMakeLists comment carried a stale premise with it: eleven defects
'deliberately reproduced and not yet fixed' stopped being the rule when SS0.1
retired the fidelity constraint.

Four told a reader to record work in TODO.md; the scanner defect is issue #4,
the audio_tables mutation gap is #25, and the UI gaps are libakgl #79 and #80.

Verified: cmake --build build && ctest --test-dir build, 112/112.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Andrew Kesterson <andrew@aklabs.net>

docs/14-architecture.md

@@ -458,7 +458,7 @@ Three consequences follow, and all three are things people report as bugs:
 
 `akbasic_Value` carries its string **inline**, not behind a pointer, so a copy is a struct
 assignment with no allocator, no refcount and no lifetime question. It costs 256 bytes per
-value; that is the trade, and it is recorded in `TODO.md`.
+value; that is the trade, and it is recorded in `TODO.md` §6.
 
 Type comes from the identifier's suffix and nothing else: `A#` integer, `A%` float, `A$`
 string, and a bare name with no suffix is a *label*. That is `akbasic_leaf_identifier_type()`,
@@ -596,7 +596,7 @@ script's mistake into an error line are wrapped around *parsing* and *interpreta
 not around *scanning*. A line with more than 32 tokens therefore escapes as an
 interpreter error — the driver prints a stack trace and exits 1, and an embedding host is
 handed a context for what is really a script's mistake. It is the same shape as the
-`VERIFY` defect above, on a path that fix did not cover. Filed in `TODO.md`; until it is
+`VERIFY` defect above, on a path that fix did not cover. That is issue #4; until it is
 closed, a host that cannot tolerate that should refuse over-long lines itself.
 
 ## Devices, and how a capability is withheld
@@ -808,7 +808,7 @@ by name when the pointer is `NULL`**, so an older host or a different backend ge
 error rather than silence.
 
 If `libakgl` cannot supply what the verb needs, **do not work around it here**. File it in
-`deps/libakgl/TODO.md`: what the BASIC verb requires, what the `akgl_*` entry point should
+`libakgl`'s issue tracker: what the BASIC verb requires, what the `akgl_*` entry point should
 look like, and what tests would cover it. Four gaps have gone upstream that way and all
 four landed.