docs: cross-reference the human-actionable backlog to GitHub issues

File the outstanding work that needs a person — hardware, an external
account, a playtest, a design decision — as GitHub issues (#14-#29),
labelled needs:human plus a P0-blocker..P3-low priority, an area and a
phase. Link each one inline from the doc bullet it came from.

The split: issues carry status for human-gated work, these documents
keep the detail, and the numbered agent-actionable tasks in
multiplayer-next.md §7 deliberately get no issues. Mark the 8.48 Compose
fixture bullet as agent-actionable so its lack of an issue does not read
as an omission.

multiplayer-next.md

@@ -29,12 +29,19 @@ service), and has a critical open blocker: see §0.
 The one place to look before planning. Everything here is also written up
 where it belongs; this is the index, not the detail.
 
+Anything below that needs a *person* rather than an agent is also a GitHub
+issue, labelled
+[`needs:human`](https://github.com/jcreek/CosmicClash/issues?q=is%3Aissue+is%3Aopen+label%3A%22needs%3Ahuman%22)
+plus a `P0-blocker`…`P3-low` priority, and linked inline below. The numbered
+tasks in §7 are agent-actionable and deliberately have no issues — this
+document is their tracker.
+
 **Phase 8 (matchmaking, ranked, per-match server autoscaling) is a 1.0 launch
 blocker and is in progress.** It is larger than anything below and adds a
 backend service outside the Godot project. Tasks are in §7; the design is in
 [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md).
 
-**The current root blocker**: nothing in production ever publishes a
+**The current root blocker** ([#14](https://github.com/jcreek/CosmicClash/issues/14)): nothing in production ever publishes a
 player's signed match assignment. `store.SaveAssignment`/`SaveAssignments`/
 `SaveVerifiedAssignmentRoster` and `allocator.Service.PublishRoster` are
 fully built and tested in isolation, but no real code path
@@ -54,8 +61,8 @@ built, at the user's explicit direction, pending a decision on that design.
 
 | # | What | Why it is not done | Detail |
 |---|---|---|---|
-| A | **Phase 4 human playtest at ~100 ms RTT.** Does the ship feel local? Does the ball? Do contact corrections read as bumps or as glitches? | Needs hands on a controller. Every numeric gate is green; feel is the milestone's actual subject and no percentile can answer it. | §5.7 |
-| B | **Phase 5 3v3 gate**: a full start-to-finish match with 6 players, a mid-match disconnect, and a late joiner. | Needs a real multi-client session. Every scenario is verified at 1v1 plus a two-bot CI match; nothing has run at 3v3. | §6 |
+| A | ([#18](https://github.com/jcreek/CosmicClash/issues/18)) **Phase 4 human playtest at ~100 ms RTT.** Does the ship feel local? Does the ball? Do contact corrections read as bumps or as glitches? | Needs hands on a controller. Every numeric gate is green; feel is the milestone's actual subject and no percentile can answer it. | §5.7 |
+| B | ([#19](https://github.com/jcreek/CosmicClash/issues/19)) **Phase 5 3v3 gate**: a full start-to-finish match with 6 players, a mid-match disconnect, and a late joiner. | Needs a real multi-client session. Every scenario is verified at 1v1 plus a two-bot CI match; nothing has run at 3v3. | §6 |
 
 These two are independent and can be done in either order, but B is the
 cheaper of the two to arrange and would also exercise A's conditions
@@ -76,12 +83,12 @@ given a bespoke solution for that reason.
 
 | # | What | Detail |
 |---|---|---|
-| F | **A contact-cohort-only shadow world.** The remaining known prediction weakness is the contact cohort. Whether it is worth a client-side shadow Jolt world scoped to contacts alone is undecided — and deliberately so until A supplies the felt evidence. | §5.7 |
+| F | ([#23](https://github.com/jcreek/CosmicClash/issues/23)) **A contact-cohort-only shadow world.** The remaining known prediction weakness is the contact cohort. Whether it is worth a client-side shadow Jolt world scoped to contacts alone is undecided — and deliberately so until A supplies the felt evidence. | §5.7 |
 
 ### Unstarted phases
 
-- **Phase 6 external gate:** run the exported Docker server and clients from separate machines over the internet, then play a full match. This is a controlled test only until **C** is fully closed (i.e. Phase 7 lands).
-- **Phase 7 — Steam transport, browser, identity and production SDR** (8 tasks, in progress): the optional bootstrap and `NetTransport` foundation now exist, but custom Steam client/server export templates have not yet been supplied. Browser, verified tickets, bans, production credentials and ticketed Hosted Dedicated Server SDR await a project-owned Steamworks App ID and Valve coordination. Carries the fix for the direct-server half of **C** and is the hard prerequisite for Phase 8's production Steam identity.
+- **Phase 6 external gate** ([#20](https://github.com/jcreek/CosmicClash/issues/20))**:** run the exported Docker server and clients from separate machines over the internet, then play a full match. This is a controlled test only until **C** is fully closed (i.e. Phase 7 lands).
+- **Phase 7 — Steam transport, browser, identity and production SDR** (8 tasks, in progress; its two human prerequisites are [#15](https://github.com/jcreek/CosmicClash/issues/15) App ID and [#16](https://github.com/jcreek/CosmicClash/issues/16) export templates): the optional bootstrap and `NetTransport` foundation now exist, but custom Steam client/server export templates have not yet been supplied. Browser, verified tickets, bans, production credentials and ticketed Hosted Dedicated Server SDR await a project-owned Steamworks App ID and Valve coordination. Carries the fix for the direct-server half of **C** and is the hard prerequisite for Phase 8's production Steam identity.
 
 Phase 6's external gate has no dependency on Phase 7 for a controlled test,
 but Phase 7 is next in priority because Steam identity is required before