docs: reframe novelty claim to composite write-time contract (review MAJOR #3)

Replace the unverified/absolute novelty statement with the defensible
four-part-contract form, verified against a focused adversarial PyPI+GitHub
survey (2026-07-15):

- BRIEF §11: 'assumed, not verified' -> verified survey with sources. Names
  aig-guardian (real, query-time; blurs only the minimal-dep-library
  differentiator), GuardLLM (nearest neighbour, runtime hardening, no
  scan-before-persist / capability isolation / fail-secure), and ipi-scanner
  (orphaned placeholder repo, recorded for honesty not as prior art).
- README: differentiator moved from 'library vs hosted/model' to the full
  four-part write-time contract.
- PLAN §27-31: drop the unverifiable 'the first' superlative.

Also promotes the v1.0 session plan (PLAN-v1.md) and the cross-model review
(review-2026-07.md) into docs/ on the open/ mirror, referenced by PLAN.md's
re-sequencing addendum.

README.md

@@ -17,11 +17,15 @@ wiki). It packages the architectural contract — sanitize → fence → tool-le
 quarantined transform → per-stage capability isolation → scan output before
 commit → fail-secure — as composable, stdlib-first, framework-agnostic code.
 
-The gap it fills is **not** "no one detects injection." It is a small *library*
-(not a hosted service, not a fine-tuned model) that packages the **write-time
-ingestion contract** — the part query-time tooling structurally cannot see,
-because a poisoned artifact committed at write time is read by a *downstream*
-agent whose guardrail never sees where it came from.
+The gap it fills is **not** "no one detects injection." Existing OSS tools are
+either single-stage *detectors* — they emit a risk verdict and leave quarantine,
+capability isolation, scan-before-persist, and fail-secure disposition to the
+integrator — or runtime content-hardening that guards material as it *enters* the
+model. This library packages the full **write-time ingestion contract** as
+composable code: the part query-time tooling structurally cannot see, because a
+poisoned artifact committed at write time is read by a *downstream* agent whose
+guardrail never sees where it came from. (Nearest neighbours surveyed in
+`docs/BRIEF.md` §11.)
 
 **Status:** `v0.1`, alpha. The stdlib-only core is built and tested — ten
 detector/contract modules and the top-level wiring, exercised by an end-to-end