docs(readme,limitations): stop advertising a version that was not chosen

LIMITATIONS said "Since 0.3.5" and the README stated the new refusal in present
tense under a 0.3.4 badge and a @v0.3.4 install pin. Both are on the public
mirror, and both contradict the same commit's CHANGELOG ("the version this lands
under is not yet decided") and what we told llm-ingestion-okf an hour earlier:
no tag until they answer.

A reader installing the advertised pin would get a library that does not do what
the README says. Same failure the clean-venv rule already covers for tags —
extended to behaviour.

Also fixes a test that passed for the wrong reason: `"101" not in details` is
tuple membership over ("sanitize",), trivially true, and would stay true if a
size were ever folded into the string. Now a substring check, matching the
canary assertion two lines above it.

README.md

@@ -90,9 +90,11 @@ the disposition is `FAIL_SECURE`, never a silent persist. Pass
 together with a transform failure is treated as a probable forced-fallback attack
 and halts regardless of trust tier.
 
-`prepare_input` fails **closed** on size too: above `MAX_INPUT_CHARS`
-(1 000 000) it raises `OversizeInputError`, a `ContractViolation` subclass, rather
-than returning a half-sanitized document. The scanners bound their work by
+**Unreleased — on `main`, not in `v0.3.4`.** The tag advertised above does not do
+this yet; the version it lands under is still open. `prepare_input` fails
+**closed** on size too: above `MAX_INPUT_CHARS` (1 000 000) it raises
+`OversizeInputError`, a `ContractViolation` subclass, rather than returning a
+half-sanitized document. The scanners bound their work by
 reading a prefix and flagging, which costs only detection in the tail; a
 transform returns *content*, where the same move would either drop your data
 silently or hand back an untransformed tail — the exact place an attacker would