docs(readme,limitations): stop advertising a version that was not chosen

LIMITATIONS said "Since 0.3.5" and the README stated the new refusal in present
tense under a 0.3.4 badge and a @v0.3.4 install pin. Both are on the public
mirror, and both contradict the same commit's CHANGELOG ("the version this lands
under is not yet decided") and what we told llm-ingestion-okf an hour earlier:
no tag until they answer.

A reader installing the advertised pin would get a library that does not do what
the README says. Same failure the clean-venv rule already covers for tags —
extended to behaviour.

Also fixes a test that passed for the wrong reason: `"101" not in details` is
tuple membership over ("sanitize",), trivially true, and would stay true if a
size were ever folded into the string. Now a substring check, matching the
canary assertion two lines above it.

docs/LIMITATIONS.md

@@ -303,7 +303,8 @@ items; this is the full list, each with the mechanism.
   at all.
 
 - **Two detection surfaces still accept unbounded input; the transform surfaces
-  no longer do.** Since 0.3.5 `sanitize`, `fence` and `neutralize` raise
+  no longer do.** Unreleased, on `main` at `2d98d68`: `sanitize`, `fence` and
+  `neutralize` raise
   `OversizeInputError` above `MAX_INPUT_CHARS` (1 000 000) rather than returning
   a partially transformed document, which bounds the whole input path — `sanitize`
   is step 1 of `prepare_input`, and it only ever removes, so everything after it