Document PBHP status and locked release boundary

[PauseBeforeHarmProtocol]

Outcome

This documentation-only repair puts the preserved PBHP repository behind an accurate current-status and governance boundary without changing protocol or Python logic.

Changes

• documents the April 19 snapshot's existing version skew: v0.9.5 filenames/top-level VERSION, with 17 post-audit fix categories implemented across 103 source/protocol lines explicitly labeled v0.9.6
• records the locked Project Shadow R1, Primitive Commons, custody-only, and separate Myth v0.3.4 identities
• pins the fully verified public-release candidate 2f8fe1530b6a83294d15011df95853aaecf08fa4dba756f0c2e91dd089e1b1ec as pending separate exact-hash authorization
• corrects MIT vs CC BY-SA path-based license descriptions
• reframes governance, roadmap, and contributions as evidence-preserving maintenance
• bounds test, efficacy, safety, production, certification, and compliance claims
• removes the personal Gmail address from contribution guidance
• updates canonical repository links

Preserved

• no src/, protocol/, package, artifact, or workflow file changed
• the exact supplied PBHP-ULTRA file remains byte-identical
• no AM, Harlan Ellison, direct story-title, Myth payload, Project Shadow payload, custody archive, or Primitive Commons package was added
• the candidate is not embedded or authorized by this PR

Verification

• 730 tests passed; 20 subtests passed
• 608 pre-existing warnings retained
• changed-file Markdown local links: PASS
• git diff --check: PASS
• complete local patch SHA-256: 1578589eeb4777c7901f16e2010e7efa37c0ea6fdd9b3f6802ca6c6f02b5abd1

The obsolete 542-file July currentization PR #1 was closed without merge and retained only as historical provenance.