docs(plan): scope the self-safety claim -- ReDoS duty is the lexicon path, not output

PLAN.md's test-plan line read as if both scan paths carried ReDoS coverage.
f74245f measured that the output path's "pathological" payload is the FASTER
side against size-matched ordinary prose (0.93x / 0.96x, order swapped), so it
does not exercise catastrophic backtracking at all.

Leaving the line unscoped would be the same defect c0899e9 just retracted in
LIMITATIONS.md: a committed claim resting on a premise now known to be false.

Names which path carries which duty and says plainly that a crafted payload for
the output regexes does not exist. No new limitation bullet -- 27 stays 27.

docs/PLAN.md

@@ -132,7 +132,11 @@ Maximal reuse: most detection logic is a JS→Python **port**, not new code.
 - **Contract asserters** — a tool-carrying request and a credential-leaking stage env both
   raise; the happy path passes.
 - **Self-safety** — pathological/ReDoS-prone and oversize input return within a bound,
-  never hang.
+  never hang. Scope, measured 2026-07-31: the ReDoS half is carried by the *lexicon*
+  path alone (`test_redos_pathological_subagent_input_returns_fast`, crafted against a
+  known-bad nested `.*?`). The `output` path's bound is a no-hang guard only — its blob
+  is *slower* than size-matched ordinary prose (0.93x/0.96x), so it does not exercise
+  catastrophic backtracking. A crafted payload for the output regexes is not written.
 - **Neutralize** — active-content output is defanged; clean output is byte-identical.
 - **End-to-end showcase (the FINAL deliverable, built last).** One realistic
   piece of ingested content that carries *many* vulnerabilities at once — visible