docs(scope): expand roadmap to cover all eight OKF surfaces

Operator decision: the initial v1 boundary (portfolio pair only) left
five of eight OKF surfaces uncovered. CLAUDE.md/README now define a
four-phase roadmap: door A, doors B/C, configurable bundle contract
(wiki strict-v1), and a zero-dep Node/ESM half for the second-brain
plugin world. Halves share contract and fixtures, never code. Security
stays with llm-ingestion-guard in both runtimes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QeqhJpYQyghASjiJo5EhGg

README.md

@@ -40,20 +40,34 @@ Security is owned by the sibling package
 
 No security functionality is reimplemented here.
 
-## Non-goals (v1)
+## Roadmap
+
+The library is built in four phases so that every known OKF surface in the
+ecosystem is eventually covered:
+
+1. Spec-based ingestion (Python) with byte-exact golden fixtures.
+2. Bundle inbox and external-bundle import (Python), guard-gated.
+3. Configurable bundle contract (types, layers, frontmatter sets, and
+   reserved-file policy as configuration), enabling stricter bundle
+   profiles such as `strict-v1`.
+4. A `node/` half: a zero-dependency Node/ESM package (importable and
+   CLI-invokable, vendored per consumer) providing bundle checking, index
+   generation, inbox processing, and document conversion for the OKF
+   second-brain plugin ecosystem. The Python and Node halves share the OKF
+   contract and fixture suite, not code.
+
+## Non-goals
 
-- The `strict-v1` bundle profile used by `claude-code-llm-wiki` (candidate
-  for v2; requires a configurable bundle contract).
-- A Node/JavaScript port for the OKF second-brain plugin ecosystem, which is
-  deliberately Node/ESM zero-dependency. See CLAUDE.md for the recorded
-  decision criteria.
 - Verdict/feedback machinery from the method specification (stays in the
   consuming repositories).
 - Embedding- or retrieval-layer functionality.
+- Security functionality, in either runtime — that is always
+  `llm-ingestion-guard`'s domain.
 
 ## Requirements
 
-Python 3.10+. The core has zero runtime dependencies.
+Python 3.10+. The core has zero runtime dependencies. The planned Node half
+targets Node/ESM with zero npm dependencies.
 
 ## License