docs(nip-fi): correct Blossom compliance note — strict verifier gates on #7264

The strict verifier exists but runs in Permissive mode until the NIP-FI
HTTP enforcement PR (#7264) merges and the stub in
blossom_strictness_from_state is replaced with the live mode derivation.
The deny-map gap (S4) is still a named known gap.

Remove the premature 'now compliant' claim and state exactly what is true:
verifier hardening implemented, engagement conditional on #7264 landing,
deny-map pending S4.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Author: Duncan

docs/nips/NIP-FI.md

@@ -678,9 +678,15 @@ constitutes a **known gap** in this section's security guarantees.
 
 #### Compliance note
 
-The gaps named in previous revisions (multi-tag acceptance, 3600-second proof
-window, and an optional `server` tag) are resolved as of the bounded hardening
-PR.  The implementation is now compliant with this section.
+The strict verifier (exact cardinality, mandatory `server` tag, 60-second proof
+window, and 401/403 denial-class split) is implemented in `buzz-media/src/auth.rs`
+as `BlossomStrictness::Strict`.  It is engaged when NIP-FI active modes are
+configured; deployment requires the NIP-FI HTTP enforcement PR (#7264) to be
+merged first.  Until that PR lands the verifier runs in `Permissive` mode,
+which preserves pre-NIP-FI behavior [FI-INV-15].
+
+The deny-map gap described above remains a **known gap** pending the S4
+issuer-scoped deny-map integration.
 
 ### Request format