docs(readme): honest-limits for the two-stage upload inbox (stage 2f)

Concede the binary layer that survives text extraction as out-of-scope (a
shipped control): VBA/macros, OLE/embedded objects, OCR-needed image text,
font/render stego, encrypted files. Point to the two-stage OKF inbox showcase as
the worked example, and list the known gaps (.xlsx/.pdf deferred, .docx tables,
grouped .pptx shapes, numeric CSV -/+ FP).

README.md

@@ -124,6 +124,19 @@ that a green scan means safe content:
   `pypdf`/`python-docx`/archive deps). Extract text first, then scan it with the
   high-untrust upload provenance. OCR-embedded instructions and multimodal stego
   in images/PDFs are out of scope beyond the sanitizer's character-layer stripping.
+- **Uploaded files: only the *extracted text* is scanned.** The two-stage OKF
+  inbox showcase (`tests/test_okf_inbox_uploads.py` + `tests/inbox_frontend.py`, a
+  dev-scoped demonstration whose `python-docx`/`python-pptx` parsers live in the
+  `[dev]` extra, never core `dependencies`) reads `.txt`/`.md`/`.csv`/`.docx`/
+  `.pptx`, folders and `.zip`, materializes them into an OKF bundle, then guards
+  it. What survives text extraction is **out of scope**: VBA/macros
+  (`.docm`/`.xlsm`/`.pptm`), OLE / embedded objects, image-embedded instructions
+  needing OCR, font/render steganography, and encrypted / password-protected files
+  — the binary layer needs a separate scanner. The front-end owns the container
+  threats it *can* see (zip-slip → path gate, zip-bomb → size cap, symlink
+  refusal, CSV formula-lead cells). Known gaps: `.xlsx` (openpyxl) and `.pdf`
+  extraction, `.docx` tables, grouped `.pptx` shapes, and the numeric `-`/`+` CSV
+  false positive.
 - **Lexicon findings are deduplicated by pattern id** — `count=1` and the first
   offset are reported, so the same class matched across several channels/variants
   collapses to one finding at its first location. This keeps reports readable, but