docs: clarify COMA security and distribution scope

[lukisch]

What changes

• Corrects documentation of COMA's network, process, privilege, writer, probe, adapter, cleanup, and legal boundaries.
• Updates install and starter examples, API names, metadata, integration links, and the current Unreleased notes.
• Stops tracking maintainer-only findings and marketing logs while retaining them locally as ignored files.
• Removes obsolete text-only marketing assertions; runtime behavior and version 0.3.2 remain unchanged.

Validation

• python -m ruff check .
• python -m compileall -q coma comas tests
• python -m pytest -ra -v: 301 passed in the clean tracked checkout
• PEP 517 wheel and sdist built in an isolated clean tracked checkout; package archives checked for care-log material
• CLI help/adapters and role-starter smoke passed without starting a provider
• git diff --check

No release or package publication is included. The PyPI project named coma is unrelated; install instructions use this GitHub repository.

Review focus: claim scope and EN/DE consistency, Markdown navigation/examples, tracked-file hygiene, unchanged runtime/API behavior, and frozen version 0.3.2.

[github-actions]

Welcome! 👋 Thanks for your first pull request in this repository.

A maintainer will review it soon. Please make sure:

• Your changes are tested
• Documentation is updated if needed
• The PR description explains what and why

Thanks for contributing!

[lukisch]

Isolated Luna review at exact PR head 102fe645c1a60aff25cbb028d1b78b73b2278056 (base 8f26cf71b6e1161c3987c5fe0192c6ba8c7a02e2).

The documentation and module metadata now describe COMA as an agent-process lifecycle layer with file-based coordination and optional starter generation, reflecting the reviewed subprocess, network, permission, writer-convention, and best-effort-cleanup boundaries. No sandbox or provider guarantee is claimed.

Validation: all 24 final CI matrix checks passed (runs 38171219007 and 38171215598). Ruff and diff checks passed; the final two-line .gitignore cleanup removes only redundant host patterns. The isolated full suite passed 301/301 with jsonschema enabled on the prior reviewed head; the author reports 301/301 after the final cleanup. Twelve dated/marketing-text assertion tests were removed while functional tests remain. Internal care logs are untracked and excluded from the reviewed wheel and sdist artifacts. Version 0.3.2 remains frozen; no release or upload was made.

Scope follow-up: generated relative schema provenance and test discovery are unchanged. Three local drift checks and the central check found no drift; configurable neutral provenance is documented for follow-up. No live provider was started, and this review is not a provider or security certification.