findings: adopt the registry in the app module; rename ipv6.* to v6.*

The registry was only used in core-engine. The app still emitted seven codes as
raw strings, so the registry test passed while codes lived outside it - among
them ipv6.broken, which fired on a real network and was in no registry at all.

All seven now take their code, category and severity from a registry entry, so
those three cannot disagree at a call site. Grepping for code = "..." across the
app, engine and probe modules now returns nothing.

ipv6.* -> v6.* is the third instance of the same rule being broken: they
declared Category.IPV6 while the prefix map only knows "v6", so
TestType.category("ipv6.broken") fell through to connectivity and the finding
rolled up under the wrong verdict light. The test-type registry already used v6.

Two severities reconciled rather than assumed:

  connectivity.captive_portal is medium, not high. The registry had guessed
  high; the probe emitting it had always said medium, and the probe was the
  considered value - a captive portal on hotel wifi is what should be there.
  no_internet keeps high, since nothing local fixes that.

  v6.not_offered stays info, and the registry now says why it must. Most
  networks still do not offer IPv6; a warning there lights a yellow verdict on a
  healthy network and teaches people to ignore the light.

Plus a BackHandler: the screen was a plain state variable with nothing tying it
to the back stack, so Back left the app from Settings/History instead of
returning to the run screen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/build-status.md

@@ -914,3 +914,30 @@ Three tests, one of which uses the exact value observed on the wire.
 Worth recording as a reasoning trap: I had originally raised this as "ULA should probably be kept
 verbatim, like RFC1918, for consistency". The surface analogy pointed the wrong way, and the
 correct answer was the opposite.
+
+### Registry adopted everywhere; v6 findings renamed; Back works (2026-08-01)
+The findings registry was only adopted in `core-engine`. The app module still emitted seven codes
+as raw strings, so the registry test passed while codes existed outside it — including
+`ipv6.broken`, which fired on a real network and was in no registry at all.
+
+All seven now reference registry entries for code, category and severity, so those three cannot
+disagree at a call site. A grep for `code = "…"` across the app, engine and probe modules returns
+nothing.
+
+**`ipv6.*` → `v6.*`.** The third instance of rule 1: they declared `Category.IPV6` while the prefix
+map only knows `v6`, so `TestType.category("ipv6.broken")` fell through to *connectivity* and the
+finding rolled up under the wrong verdict light. The test-type registry already used `v6.`.
+
+Two severities reconciled while merging:
+- `connectivity.captive_portal` is **medium**, not high. The registry had guessed high; the probe
+  that emits it had always said medium, and the probe was the considered value — a captive portal
+  on hotel wifi is what should be there, and logging in clears it. `connectivity.no_internet` is
+  the high one, because nothing the user does locally fixes that.
+- `v6.not_offered` is **info, and the registry says it must stay info**. Most networks still do not
+  offer IPv6 and that is not a fault; a warning here lights a yellow verdict on a healthy network,
+  which teaches people to ignore the light.
+
+Also: a `BackHandler` now returns from Settings/History to the run screen. The screen was a plain
+state variable with nothing connecting it to the back stack, so the system Back gesture left the
+app entirely. Enabled only when there is somewhere to go back to, so Back still exits from the run
+screen.