docs: explain verification boundaries

[adity982]

Summary

• document the exact npm and GitHub inputs fetched during verification
• explain bounded temporary extraction and cleanup behavior
• state the static-analysis limitations and why a clean result is not a safety guarantee
• add pinned npm and GitHub verification examples

Closes #27

Validation

• npm exec -- vitest run tests/verify.test.ts tests/github.test.ts tests/corpus.test.ts (19 passed)
• npm run build
• documentation contract checks
• npm test (35 passed, 1 unrelated Windows JSON path-escaping assertion failure in tests/audit.test.ts)