docs(readme,security,contributing): meet the repo standard — 0 ERROR

The per-repo gate flagged four ERRORs and two WARNs. Fixed, in the order the
work actually gets done in:

MISSING
- `## Honest limitations` -> `## Known limitations`, `## Out-of-scope
  (documented boundary)` -> `## Non-goals`. Both sections existed under names
  no reader or agent scans for; the contract wants predictable top-level
  headings. Pointers followed: the in-README anchor, SECURITY.md's out-of-scope
  preamble, CONTRIBUTING.md's scope section, and the consumer-facing
  docs/ADOPTION-BRIEF.md. Historical records (CHANGELOG, docs/PLAN.md,
  docs/OKF-INGESTION-BRIEF.md) keep the name they were written with.

WEAKENING
- README now opens with one line identical to the forge description, above the
  badges. That is the only place a machine can check description == README.
- Forge description shortened 207 -> 178 codepoints (bound 180), and the same
  string written to pyproject's `description` so the fourth copy cannot drift.

The tests badge is dropped, not updated. `tests-699_passing` as a static image
is a claim dressed as evidence: there is no CI runner on this forge, so nothing
verifies it. Replaced with the honest substitute in Install — the single command
that runs the suite from a clean clone, stated together with the fact that
nothing runs it automatically.

Two WARNs deliberately left standing:
- H1 `# llm-ingestion-guard` != repo name. The register itself records
  llm-ingestion-guard as "a package, not a repo"; the H1 names what you pip
  install. Renaming the repo is the operator's call, not this commit's.
- The `Status` badge trips the same claim-badge regex, but `alpha` asserts
  maturity, not a run — the same reason version/license/platform are exempt.
  Measured false positive in the gate's classifier, reported upstream.

README.md

@@ -1,9 +1,10 @@
 # llm-ingestion-guard
 
+Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
+
 ![Version](https://img.shields.io/badge/version-0.3.4-blue)
 ![Status](https://img.shields.io/badge/status-alpha-orange)
 ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
-![Tests](https://img.shields.io/badge/tests-699_passing-green)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
 **Write-time ingestion is the trust boundary that query-time guardrails
@@ -53,6 +54,14 @@ are not required — the core is deterministic and dependency-free.
 **Tags are the stable contract.** Every release is version-synced before tagging,
 and published tags are never moved.
 
+**Verify it yourself — nothing runs the suite automatically.** There is no CI
+runner on the forge, so the test count is not something a badge can honestly
+assert. From a clean clone:
+
+```bash
+pip install -e ".[dev]" && pytest        # the whole suite
+```
+
 Two consequences worth knowing before you depend on this:
 
 - A git URL is a PEP 508 *direct reference*: it pins one exact tag, not a range
@@ -173,7 +182,7 @@ source of truth for
 total recall over every class, that every documented gap still holds (a closed gap
 fails the test), and that every lexicon pattern has a case — so the matrix cannot
 fall behind the code. The four classes it deliberately does **not** stop are called
-out in [Honest limitations](#honest-limitations).
+out in [Known limitations](#known-limitations).
 
 ## The reusable contract (adopt-this checklist)
 
@@ -201,7 +210,7 @@ The actual product is this checklist, encoded as code you wire in order:
 Steps 1-2 are `prepare_input`; steps 6-7 are `screen_output`; steps 3-5 are
 yours; the contract asserters harden step 3-4.
 
-## Honest limitations
+## Known limitations
 
 Conceding these plainly is itself a control — it prevents the false assurance that
 a green scan means safe content. The highest-impact items:
@@ -230,7 +239,7 @@ a green scan means safe content. The highest-impact items:
 [`docs/LIMITATIONS.md`](docs/LIMITATIONS.md). Several carry field measurements from
 consumer corpora, including the false positives the URL-shape rule actually produces.
 
-## Out-of-scope (documented boundary)
+## Non-goals
 
 Embedding/vector-layer defenses (OWASP LLM08, downstream of persist); multimodal
 steganography; query-time / runtime guardrails; semantic factuality verification.