docs(plan): add end-to-end showcase pipeline test as the final deliverable

One realistic content sample carrying many vulnerabilities at once, run through
a mock ingestion pipeline (sanitize -> lexicon+entropy+decode-rescan -> output
gate -> disposition); assert every planted vuln is caught and disposition fails
secure. Doubles as the README worked example. Added to build-order step 11 and
the test strategy; tracked as task #11. Inspiration: llm-security/examples/*.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K8GmKRCdsPjWYAKWsNgeQS

docs/PLAN.md

@@ -93,7 +93,8 @@ Gap additions folded into v1 (from the security-coverage research):
 9. `contract` — tool-less assert; per-stage credential allowlist; env-scoping helpers
 10. `grounding` — protocol/interface only in core
 11. Top-level `__init__` wiring the §6 checklist; `pyproject.toml`; `LICENSE`; README
-    (positioning + honest limitations); adversarial + false-positive corpora
+    (positioning + honest limitations); adversarial + false-positive corpora; the
+    end-to-end showcase pipeline test (see Test strategy — built LAST)
 
 ## Reuse map — `llm-security` v7.8.0 (MIT, same author)
 
@@ -128,6 +129,15 @@ Maximal reuse: most detection logic is a JS→Python **port**, not new code.
 - **Self-safety** — pathological/ReDoS-prone and oversize input return within a bound,
   never hang.
 - **Neutralize** — active-content output is defanged; clean output is byte-identical.
+- **End-to-end showcase (the FINAL deliverable, built last).** One realistic
+  piece of ingested content that carries *many* vulnerabilities at once — visible
+  + zero-width/BIDI/Unicode-tag stego carriers, homoglyph + whole-string-base64 +
+  rot13-hidden injection, HTML-obfuscated and cognitive-load-buried payloads,
+  secret/PII egress in the enriched output, and active-content exfil links — run
+  through a mock ingestion pipeline (sanitize → lexicon+entropy+decode-rescan →
+  output gate → disposition). Assert every planted vulnerability is caught and
+  disposition fails secure. Doubles as the README's worked example. Inspiration:
+  `llm-security/examples/{prompt-injection-showcase,poisoned-claude-md,lethal-trifecta-walkthrough,toxic-agent-demo}`.
 - **No network in any test.**
 
 ## README "Honest limitations" (shipped as a control)