docs: MCP schema fingerprint honesty (r/mcp feedback)

[blitzcrieg1]

Summary

• README Coverage and Limitations: tripwire vs stable server, first observation is not a trusted baseline, additive fields / OAuth / failed fetches
• S7 Splunk note points at the same limits
• Follow-ups filed: mcp_schema: dual digests (model-visible strings vs structural residue) #103 dual digests, mcp: tools/call response-shape / arg-validation drift (list-stable call-divergent) #104 call-time drift, mcp_schema: auth/session-aware fingerprinting for OAuth-gated listings #105 auth-aware fingerprint, mcp_schema: failed fetch (410/empty) must not score as tools removed #106 failed-fetch vs tools-gone

Test plan

• Docs only; no freeze files touched