fix: bound README claims and preserve plaintext PHI warnings

[abrichr]

What changed

Bound the product opening to evidence

• Describes browser, legacy-desktop, and remote-display interfaces as intended
  scope while stating that every target application and environment is
  qualified separately.
• Retains the supported architecture claims: deterministic local programs,
  zero model calls on healthy runs, retained-evidence re-resolution, governed
  repair, and halt on verification failure.
• Adds any repeated GUI task, demonstrated once, and replays exactly to
  the README consistency gate, with a regression proving each phrase is
  refused.

Restore the plaintext-PHI warning boundary

• Removes the synthetic_demo warning bypass added by docs: surface machine-checked claims + fix community funnel (--version, question routing) #137 from the CLI and
  report renderer.
• A replay without --url serves MockMed, but it still accepts an arbitrary
  user-supplied bundle. MockMed target selection therefore cannot prove that
  the bundle's recorded intents are synthetic.
• Adds a focused end-to-end CLI regression: an arbitrary PHI-bearing bundle
  replayed through the default MockMed route still emits
  PlaintextPHIWarning.
• Preserves the explicit UTF-8 report.json read introduced by the
  cross-platform CI repair.

Why

The README opening had turned product direction into universal present-tense
availability. That exceeded the bounded desktop evidence and unqualified real
Citrix path, while promising one-demonstration sufficiency and exact replay.

Separately, #137 treated “default target is MockMed” as provenance for the
bundle. That inference is unsafe because the bundle path is arbitrary; real
identity text can still be rendered to REPORT.md. The warning now has no
implicit bypass. An operator can still explicitly choose SCRUB=off, while
SCRUB=on remains fail closed.

The branch history-preservingly merges exact released main
bc8f5953d2dfb05739417d211655e3f3d8b27af4 (Flow 1.12.0), including #135's
native macOS acceptance and #139's capture 0.5.4 integration. Capture,
effect-kit, macOS evidence, package, lock, and release files remain identical
to that main ancestor except where the focused CLI test integration naturally
shares files.

Validation

• python scripts/check_consistency.py
• python scripts/validate_claims.py --check
• Focused CLI/report/privacy/claims/macOS/effect-config suite — 202 passed
• ruff check on the changed Python and regression files
• ruff format --check on the changed Python and regression files
• mypy openadapt_flow/__main__.py openadapt_flow/report.py
• git diff --check
• Verified bc8f5953d2dfb05739417d211655e3f3d8b27af4 is an ancestor of this head

No pull request is merged by this change.