docs(qc): update Section 21 status for worker and legal routes

Author: cursoragent

docs/qc/SECTION_21_STATUS.md

@@ -32,7 +32,7 @@ It is not yet a qualified release record.
 
 ## Still open before qualification
 
-- [ ] 21.0 Hosted URL and worker deployment evidence.
+- [ ] 21.0 Hosted worker URL (public Render/Fly deploy). Web app and worker execution paths are implemented; set `VITE_WORKER_BASE_URL` on Pages when a worker is live.
   The static app is now hosted at `https://chayprabs.github.io/csv-jsonl-miller/`, and a direct HTTP check returned `200`.
   GitHub Actions on `main` now show green `CI`, `Deploy Pages`, and `Publish Worker Image` runs, with the latest worker image evidence coming from run `26607788767` (`8d843f4`).
   The repo now also includes a Render Blueprint in `render.yaml` plus deploy notes in `docs/deploy/RENDER_WORKER.md` for a public worker URL.
@@ -59,4 +59,7 @@ It is not yet a qualified release record.
   The worker now has repo-owned Render deployment config in `render.yaml`, but there is still no applied hosted worker instance.
   There is still no registry publication evidence from npm or GitHub Packages.
   Direct container package inspection is still blocked by the current token missing `read:packages`, and there is still no hosted worker endpoint.
-- [ ] 21.19 Final all-green verdict.
+- [x] 21.4 Worker URL fetch executes on worker (`/v1/run` with `source.kind=url`).
+- [x] 21.4 Worker native DuckDB/Miller plans execute from web client (`Run on worker`).
+- [x] 21.10 Privacy and terms routes with dedicated SEO metadata.
+- [ ] 21.19 Final all-green verdict (blocked on hosted worker URL + browser Miller-WASM upstream limit).