docs(cli): document request controls and session limitations #16

[yashiels]

Summary

• Document the merged request pacing, rolling admissions, persistent refusal/cooldown behavior, local safety commands, diagnostics and fail-closed state requirements.
• Preserve exact application/job-verification evidence and owner-consent rules while correcting dry-run defaults, credential JSON storage, unsupported environment settings and obsolete retry/debug claims.
• Explain legacy Android compatibility headers, actual Go/browser-cookie provenance and the limits of the separately dated APK audit without claiming native-session or ban immunity.
• Documentation only: README, authoritative CLI skill, compatibility reference and factual AGENTS corrections. Depends on merged feat(api): enforce durable request budgets and refusal stops #15 #18.

Verification

• Reviewed signed head b9aad1c5cf74c628f699728978c519f1aeb93eb6.
• Independent macOS make ci/race, lint and scratch build passed.
• Independently exercised 23 help leaves, exact local JSON/exit behavior, isolated confirmed resume preserving cooldown/history, stricter shared-state configuration and invalid-config refusal. No owner credentials or live traffic used.
• Native Linux actual unchanged CI workflow passed vet, race tests and gofmt across all 10 packages, including both native ACL cases. All 86 exported source paths, Git blobs and executable modes verified before and after execution.
• Policy/state and credential/permission/identity meaning-drift reviews both signed off on this exact artifact.
• Existing ATS/application evidence block preserved byte-for-byte. Skill frontmatter directly validated; description is 56 characters. The optional generic validator lacked PyYAML and is not counted as a pass.

No runtime behavior, dependencies, workflow, credentials or account state changed. Release/install verification follows this merge and does not authorize live provider requests.

Closes #16

[sentinel-skyner]

🛡️ Sentinel review

No material issues found in this docs-only diff.

_{Automated review via cursorbridge:gpt-5.3-codex. Findings only — not an approval. Push new commits to re-review.}