docs: the export's device checks are a release gate, not a memory

The Storage Access Framework path is covered by Robolectric — the intent
contract, the bytes reaching the stream, a failing stream never reported as
done, and cacheDir empty afterwards — but no test reaches a real document
provider, and the picker UI itself has not been driven on a device.

Recorded as three checklist rows rather than claimed. The only emulator running
on this machine belongs to another project, and starting one on top of it was
not worth the contention.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/security/SECURITY_CHECKLIST.md

@@ -62,6 +62,9 @@ The one group that is not generic. Every item proves part of
 - [ ] Release build has verbose logging off and no raw cycle date in any crash payload — proves §45's logging rule survived the build type
 - [ ] Delete My Data removes the rows and is irreversible after confirmation — proves the promise in Settings is true
 - [ ] Export produces only the user's own data, to a location they chose — proves export is not an accidental leak path
+- [ ] The export run once on a device, end to end through the system save dialog — proves the Storage Access Framework path works against a real document provider, which no Robolectric test reaches
+- [ ] The exported file opened and read — proves it is the human-readable archive §35 asks for, and that the dates in it are the dates the user entered
+- [ ] An export attempted while the app lock is on, returning through the lock screen — proves the destination is written only after the unlock, and written once
 
 ### The compliance bar, which is not the launch bar