docs(readme): document the real install channel; drop false PyPI claim

The Install section promised `pip install llm-ingestion-guard`, but the
distribution is not on PyPI — a downstream consumer following the README
would fail. Replace it with the channel that actually works, verified in a
throwaway venv against the public mirror:

    pip install "llm-ingestion-guard @ git+https://.../@v0.2.0"

Anonymous HTTPS read on the open/ mirror is confirmed, so consumer CI needs
no deploy key. Also states the two things a consumer must know up front:
a git URL is a PEP 508 direct reference (exact tag, not a >=0.2,<0.3 range;
range pinning arrives with a Forgejo PyPI registry at the first patch release
or second consumer), and vendoring is unsupported because it severs the
security patch channel.

Answers the install-channel question raised by llm-ingestion-okf via coord.

README.md

@@ -39,12 +39,31 @@ may still change. There are real limitations, stated plainly below; read them.
 
 ## Install
 
+Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
+
 ```bash
-pip install llm-ingestion-guard          # stdlib-only core, zero dependencies
+pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v0.2.0"
 ```
 
-Optional ML/judge detectors live behind extras (`[ml]`, `[judge]`) and are not
-required — the core is deterministic and dependency-free.
+The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or
+other credential. The core is stdlib-only with zero dependencies, so nothing else
+resolves. Optional ML/judge detectors live behind extras (`[ml]`, `[judge]`) and
+are not required — the core is deterministic and dependency-free.
+
+**Tags are the stable contract.** Every release is version-synced before tagging,
+and published tags are never moved.
+
+Two consequences worth knowing before you depend on this:
+
+- A git URL is a PEP 508 *direct reference*: it pins one exact tag, not a range
+  like `>=0.2,<0.3`. Real range pinning — and therefore automatic pickup of patch
+  releases — arrives with a Forgejo PyPI registry, which becomes the durable
+  channel at the first patch release or the second downstream consumer, whichever
+  comes first. The distribution name (`llm-ingestion-guard`) and the version
+  scheme are unchanged by that move, so pins written today keep their meaning.
+- **Vendoring the source into a consumer is not supported.** It severs the patch
+  channel that a shared security dependency exists to provide: a copied guard
+  keeps running the vulnerabilities the original has already fixed.
 
 ## Quickstart — the two bookends