docs/STATUS.md has no account of the Devin runtime

README calls `docs/STATUS.md` "the honest account - what is built and proven against a real CLI, what is built but unproven, what is broken". It has no mention of Devin, while `src/daemon/devin-session.ts` is ~700 lines and a Devin specialist is now a first-class runtime.

Things that should be in it, as of #142:

**Proven against `devin 3000.10.23`**
- ACP handshake, `authenticate` with the key from `credentials.toml` / `WINDSURF_API_KEY`, `session/new` and `session/load` resume
- per-turn and cumulative token usage off `usage_update` and the result's `usage` (#115)
- `session/request_permission` answered (#116)
- the commit-attribution gate via `.devin/hooks.v1.json` (#142)
- Bench skills discovered from `~/.config/devin/skills` (#142)

**Built, unproven**
- resume across a daemon restart with the hooks file and exclude entry already in place
- MCP servers: `session/new` sends `mcpServers: []`; whether the agent merges the project's own `.devin/mcp_config.json` has not been captured

**Broken / known**
- stall watchdog kills a healthy tool call that runs >60s without wire traffic (#143)
- no dollar or ACU figure on the wire, so Devin turns show no cost (#117)
- hung `session/new` / `session/load` has no timeout (#131)
- empty picker when `devin models list` fails (#133)

Start with docs/STATUS.md and compare its current Devin coverage with the evidence listed in this issue and the referenced issues #115, #116, #117, #131, #133, #142, and #143. Add the ACP, usage, permission, attribution, skills, resume, MCP, watchdog, cost, timeout, and picker status under the appropriate sections. Done means the document gives an honest account of what is proven, unproven, and broken for the Devin runtime.

Written by the indexing model from the issue text.