docs(llm-security): A3 honesty-sweep — 7 sitater nedtonet (critical-review §9)

Closes A3 of v7.1.0 critical-review patch. Each rewrite preserves the underlying
claim where it is accurate but removes hype/overreach language. Historical
CHANGELOG/README version-table rows are intentionally left as-is (they document
what was claimed at the time of release, not what is true today).

Changes (CLAUDE.md, commands/ide-scan.md, knowledge/mitigation-matrix.md,
docs/security-hardening-guide.md):

- "Trustworthy scoring (BREAKING)" → "Severity-dominated risk scoring
  (v2 model, BREAKING)". Removes hype framing; describes the actual mechanism.
- "Context-aware entropy scanner" → "Rule-based entropy scanner with
  file-extension skip, 8 line-level suppression rules, and configurable policy".
  No ML/context inference; just rules.
- "1487 tests" → "1511 unit and integration tests; mutation-testing coverage
  not published". Updated count after A1+A2 (+24) and added qualifier.
- "Fully Schrems II compatible" → "Schrems II compatible in default offline
  mode. Optional OSV.dev enrichment (`supply-chain-recheck --online`)
  transmits package identifiers to a Google-operated API and is a separate
  compliance consideration." Acknowledges the OSV.dev opt-in caveat.
- "Rule of Two enforcement" → "Rule of Two detection (configurable; default
  warn; blocks on high-confidence trifectas in opt-in `block` mode; distributed
  trifectas detected but not blocked by default)". "Enforcement" implied
  block; default is warn.
- "Hardened ZIP extractor" → suffix " — no fuzz-testing results published
  to date". Caps and class-of-attacks rejected are accurate; absence of
  formal fuzz coverage now stated.
- "defense-in-depth" — preserved as framing, but quantified in
  security-hardening-guide §4: "three independent detection layers with
  documented bypass classes". Each layer named, each layer's known bypasses
  pointed to (critical-review §4 evasion arsenal).

Tests: 1511/1511 green (no behavioural change).

plugins/llm-security/docs/security-hardening-guide.md

@@ -98,6 +98,15 @@ recorded in the audit trail.
 techniques before the denylist gate runs. These are **defense-in-depth** layers
 that complement the Claude Code 2.1.98+ harness-level fixes, not a replacement.
 
+The plugin's "defense-in-depth" claim resolves to **three independent detection
+layers with documented bypass classes**: (1) the Claude Code harness denylist
+(out of plugin scope, evolves with platform); (2) `bash-normalize.mjs` T1-T6
+collapse rules; (3) `pre-bash-destructive.mjs` post-normalization pattern match
++ `post-session-guard.mjs` runtime trifecta correlation. Each layer has known
+bypasses (see Defense Philosophy in `CLAUDE.md` and `docs/critical-review-2026-04-20.md`
+§4 for the evasion arsenal). Stacking layers raises attacker cost; it does not
+provide formal worst-case guarantees.
+
 | Layer | Technique | Example | Normalization |
 |-------|-----------|---------|---------------|
 | T1 | Empty quotes | `rm''-rf /` | strip `''` / `""` between tokens |