docs: version-sync + SECURITY/CONTRIBUTING + honest-limits (Session E)

- README: tests badge 275->357; status v0.1->v0.2 (repo is 0.2.0; the v1.0
  bump belongs to the Session G freeze, not this docs pass); add three
  honest-limits — lone-HIGH-in-trusted-prose->WARN, vacuous quarantine-floor,
  Cyrillic/Latin homoglyph-mix false positive.
- docs/BRIEF.md: drop "No code yet" pre-implementation framing -> implemented v0.2.
- docs/OKF-INGESTION-BRIEF.md 4: correct cross-link control language —
  absolute https / references/ targets are spec-permitted, not rejected.
- Add SECURITY.md (private Forgejo disclosure) + CONTRIBUTING.md (stdlib-only
  core, Iron-Law TDD, no trailers, Forgejo-only invariants).

README.md

@@ -3,7 +3,7 @@
 ![Version](https://img.shields.io/badge/version-0.2.0-blue)
 ![Status](https://img.shields.io/badge/status-alpha-orange)
 ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
-![Tests](https://img.shields.io/badge/tests-275_passing-green)
+![Tests](https://img.shields.io/badge/tests-357_passing-green)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
 A reusable, minimal, dependency-light defensive layer for **LLM ingestion
@@ -27,7 +27,7 @@ poisoned artifact committed at write time is read by a *downstream* agent whose
 guardrail never sees where it came from. (Nearest neighbours surveyed in
 `docs/BRIEF.md` §11.)
 
-**Status:** `v0.1`, alpha. The stdlib-only core is built and tested — ten
+**Status:** `v0.2`, alpha. The stdlib-only core is built and tested — ten
 detector/contract modules and the top-level wiring, exercised by an end-to-end
 showcase and adversarial + false-positive corpora. The public API may still
 change. There are real limitations, stated plainly below; read them.
@@ -108,6 +108,22 @@ that a green scan means safe content:
   bypassable in isolation; character-injection and novel phrasings evade it. The
   *contract* (tool-less transform, capability isolation, fail-secure) is what
   carries the security — the lexicon is defense-in-depth, not a wall.
+- **A lone HIGH finding in trusted prose disposes to WARN, not quarantine.**
+  Under `PRESET_TRUSTED_SOURCE`, §4.7 trust-scaling downgrades a single HIGH to
+  WARN (a reputable single-author source is expected to carry security
+  vocabulary), and one HIGH is not "compound" — compound escalation needs ≥2
+  findings at MEDIUM+. So a HIGH-severity injection reproduced verbatim in output
+  under a *trusted* policy persists with only a WARN. This is the §4.7 design, not
+  a miss: if your "trusted" sources can carry attacker-influenced text, run them as
+  untrusted (or add a quarantine floor) instead.
+- **The upload preset's quarantine floor is currently vacuous.**
+  `PRESET_USER_UPLOAD` sets `quarantine_default` ("any finding → at least
+  QUARANTINE_REVIEW"), but every detector emits CRITICAL/HIGH/MEDIUM only (no
+  LOW/INFO), and under untrusted trust a MEDIUM already escalates to
+  QUARANTINE_REVIEW. The floor therefore never changes an outcome in today's
+  severity set — it is defensive headroom for a future LOW/INFO finding (e.g. a
+  grounding "unchecked" marker), not an active control. Documented so the preset's
+  guarantee is not over-read.
 - **Semantic / factual poisoning is invisible** to lexicon + entropy: a
   factually false claim in clean prose carries no suspicious token. The
   `grounding` module ships only a `SourceGroundingCheck` *seam* — the deterministic
@@ -132,6 +148,14 @@ that a green scan means safe content:
   there is no way to distinguish "*about* an attack" from "*carrying* an attack";
   such content needs a deliberate, explicitly-marked escaped path, never a silent
   allow.
+- **Bilingual text trips the Cyrillic/Latin homoglyph rule.**
+  `homoglyph:cyrillic-latin-mix` (MEDIUM) flags any Latin letter adjacent to a
+  Cyrillic look-alike, so genuine bilingual prose (e.g. Russian, or mixed
+  Norwegian/Cyrillic) trips MEDIUM → under untrusted → QUARANTINE_REVIEW — a real
+  false positive for an inbox that *expects* multilingual content. A calibration
+  fix is pending (require ≥N mixed pairs, or only flag when a folded variant also
+  hits another pattern); until then, multilingual corpora over-quarantine on this
+  rule.
 - **Insider in-place edits** by a trusted author are out of the untrusted-content
   threat model.
 - **Text-only.** The core is `text -> findings`: it parses no files (no