docs(readme,limitations): stop advertising a version that was not chosen

LIMITATIONS said "Since 0.3.5" and the README stated the new refusal in present
tense under a 0.3.4 badge and a @v0.3.4 install pin. Both are on the public
mirror, and both contradict the same commit's CHANGELOG ("the version this lands
under is not yet decided") and what we told llm-ingestion-okf an hour earlier:
no tag until they answer.

A reader installing the advertised pin would get a library that does not do what
the README says. Same failure the clean-venv rule already covers for tags —
extended to behaviour.

Also fixes a test that passed for the wrong reason: `"101" not in details` is
tuple membership over ("sanitize",), trivially true, and would stay true if a
size were ever folded into the string. Now a substring check, matching the
canary assertion two lines above it.

tests/test_input_cap.py

@@ -63,7 +63,10 @@ def test_error_carries_sizes_never_content(name, call):
         call(secret * 100, 100)
     assert secret not in str(exc.value)
     assert not any(secret in d for d in exc.value.details)
-    assert "101" not in exc.value.details  # details name the surface, not sizes
+    # Substring, not tuple membership: `details` is ("sanitize",), so `"101" not
+    # in details` would pass trivially and keep passing if a size were ever
+    # folded into the string.
+    assert not any("101" in d for d in exc.value.details)
     assert name in exc.value.details