docs(limitations): close the slugger question -- both consumers read, both whitelists

okf delivered the code read we asked for: materialize.py:71 is
`[^a-z0-9]+ -> "-"`, a whitelist, so their generated-path percent-escape
exposure is structurally zero. Verified independently against their source
rather than taken on the message: the regex is where they said, both their
worked examples reproduce against the real implementation, and the only
urllib.parse.quote in their tree builds a sqlite file: URI that never touches
a filename.

That retires the "still open for the one consumer whose slugger we have not
seen" clause. The Loekkene example already in this bullet was linkedin-studio's
run output, not a prediction -- checked before rewriting, because the two
clauses read as if they contradicted each other and only one was stale.

Adds the honest half that closing the question exposes: we have now read two
whitelist sluggers and zero encodeURIComponent-class ones, so the
"produces escapes systematically" arm of this axis is still a prediction from
the transform, not a field observation.

The {tenant} placeholder result goes on the generated-path side, deliberately
not appended to the %7B sentence -- that one is a link-corpus harvesting
artifact, and merging them would re-conflate the two axes this bullet exists
to separate.

No test is owed here: the claim pins okf's regex, which this suite cannot
assert. It is verifiable only by re-reading their source.

docs/LIMITATIONS.md

@@ -152,11 +152,17 @@ items; this is the full list, each with the mechanism.
   path built with `encodeURIComponent` produces escapes systematically the moment
   titles are non-ASCII. So non-ASCII language is a *confounder* for encode-vs-whitelist,
   and the slugger class is the testable thing at a consumer — a one-line code read,
-  not a corpus census. That question is still open for the one consumer whose slugger
-  we have not seen.
+  not a corpus census. **Both consumer sluggers we have now read are whitelists**, so
+  their generated-path exposure is structurally zero rather than measured-zero; the
+  second was read on 2026-07-31 and reduces the same Norwegian input to the same
+  output. What this does *not* give us is the other half of the axis: we have never
+  seen an `encodeURIComponent`-class slugger in the field, so "produces escapes
+  systematically" above remains a prediction from the transform, not an observation.
   One sub-class worth separating: `{tenant}`/`{agent-id}` template placeholders in
   API code samples encode to `%7B`/`%7D` (26 of that corpus's 36 hits — an artifact of
-  harvesting, not of prose).
+  harvesting, not of prose). On the *generated-path* side those same placeholders
+  cannot reach that shape at all: braces and `/` are outside the grammar, so
+  `"{tenant}/{agent-id} mal"` reduces to `tenant-agent-id-mal`.
 - **A percent-escaped path also defeats tokenization, which feeds the entropy
   branch.** `%` is not in the separator class, so `NSMs%20Grunnprinsipper%20for%20IKT`
   is one 34-character token where the same title with literal spaces would be four