docs(changelog,limitations): 0.3.3 named two behaviour-change classes, there were three

Measuring the same population against the v0.3.1 tag a consumer actually pins
(scratch venv, git+file://@v0.3.1, resolved version asserted) returned 99 of 185
(53.5%) against the current tree's 98 (53.0%). Chasing the one document that
moved corrected a published claim instead of confirming it.

docs-en-fullscreen.txt disposed QUARANTINE_REVIEW at 0.3.1 and WARN now, because
markdown:link-anchor-injection stopped matching 300 characters of ordinary prose
-- a match that opened at one construct's [ and closed at a different
construct's ](...), catching the word "execute" in between. The 0.3.3 ReDoS fix
excluded [ from the anchor class and ( from the target class, which telescopes
the runaway AND deletes that false-positive class.

0.3.3's "Known behaviour changes" said "None measured" and then named two
exceptions, both about a literal (. It missed the third: an anchor can no longer
span a [, so a match bridging two separate markdown constructs no longer forms.
The correction is in our favour, but it was a behaviour change presented as
none, and only a field sweep found it.

Also lands two things the measurement needed and did not have:

- The rate is now stated for the version consumers pin, not only for the tree
  that produced it. A number measured on one tree must not be sent as if it
  described another.
- This repository's own eight published documents are 8 of 8 fail-secure at the
  upload door, reproducible from any clone with no private corpus. It is the
  first bullet of LIMITATIONS at full strength, and explicitly NOT a fourth
  population -- one eight-document corpus is an illustration, not a rate.

The population -> local-path mapping the public script deliberately omits is
recorded in docs/CONSUMER-MAP.local.md (gitignored, never reaches the mirror),
so the next session reproduces the numbers instead of re-choosing populations.

717 tests, matrix 128/128 with 6/6 gaps, LIMITATIONS still 33 items.

docs/LIMITATIONS.md

@@ -289,6 +289,21 @@ items; this is the full list, each with the mechanism.
   **Every population was swept twice and reproduced its counts exactly**, and the
   largest document in any of them is 362 kB — no document approached the 1 000 000-
   character input cap, so truncation confounds nothing here.
+  **The sharpest datum needs no corpus at all: this repository's own eight published
+  documents are 8 of 8 fail-secure at the upload door** (`python docs/fp-sweep.py
+  self-docs=docs --ext=.md` on a clone, which also picks up any untracked local
+  notes). It is the first bullet of this file at full strength — a document that
+  *describes* attacks carries the constructs it describes — and anyone can reproduce
+  it. It is deliberately **not** a fourth population in the claim above: one
+  eight-document corpus, chosen because it is the worst case, is an illustration and
+  not a rate.
+  **The rate is stable across the versions consumers actually pin**: the same
+  population measured against the **v0.3.1 tag** gives 99 of 185 (53.5%) — one
+  document more than today's 98. That one document is a *removed* false positive,
+  not a regression: `markdown:link-anchor-injection` used to match 300 characters of
+  ordinary prose by opening at one construct's `[` and closing at another's `](…)`,
+  and 0.3.3's ReDoS fix telescoped it shut. See the CHANGELOG correction — 0.3.3
+  reported two behaviour-change classes and there were three.
 - **URL fragments are not graded.** A fragment is never sent to the server, so it
   cannot carry data to the host a renderer auto-fetches, and `…/overview#section` is
   the most common shape in real documentation. The residual: a *clicked* link to an