docs: mark xr11 signed release queue

[Jess Sullivan (Jesssullivan)]

Summary

• update README status from merged xr11 candidate to signed release candidate queued in the tag-backed release workflow
• cross-link the prior workflow-dispatch proof and current tag-backed release run in the CVE table
• preserve the distinction between published xr10, queued xr11, and host boot validation

Validation

• git diff --check
• nix flake check --system x86_64-linux