feat: phase 6 generated evaluation, metrics, honest docs (findings 12, 14)

[Chirudeva-Reddy]

Phase 6 of the architecture improvement plan. Stacked on phase-5-integrations: review only this PR's commits.

feat: phase 6 generated evaluation, metrics, honest docs (findings 12, 14)

• sentinel eval [--json|--markdown]: detection and false-positive rates from the corpora, now
  shipped in the package (sentinel/corpus/). It reports three separate attack rates (flagged,
  stopped on detector evidence, stopped under default policy) so deny-by-default can't inflate
  the headline number.
• docs/BENCHMARKS.md is generated; tests/eval fails if it drifts from the code, and gates
  flagged >= 95%, detector-stop >= 85%, FP <= 5%.
• Attack corpus 15 -> 42 cases, covering every Phase 1 bypass row plus fullwidth, zero-width,
  hidden-markdown, IFS, gopher/IPv6/v4-mapped SSRF, revshell and DB privilege cases.
  Current: 100% flagged, 88% stopped by detectors, 0/50 false positives. Misses are listed.
• Reading credential material (id_rsa, .env, .aws/credentials, /etc/shadow, .pem, kubeconfig)
  is now CRITICAL on its own (attacks/ssh_key_read: WARN -> REQUIRE_APPROVAL).
• GET /metrics (Prometheus text, no new deps): decisions, output-guard hits, detector errors,
  inspect latency, pending approvals.
• README and ARCHITECTURE rewritten to match the code: removes the LangChain/CrewAI, "AST",
  0.06 ms and "100%" claims; documents the threat model, keys and known limits.

Not done: AgentDojo run (needs paid LLM calls), ML detector plugin, OpenTelemetry spans.

fix: sentinel eval uses throwaway HMAC keys instead of persisting them to SENTINEL_HOME

AuditLedger and ApprovalCoordinator accept an explicit key.

Checks

• ruff check, ruff format --check, mypy --strict, pytest --cov pass locally on Python 3.10–3.13.