Fix authoritative verification documentation

[batbrainy]

Closes #35.

Authoritative fresh-clone review after PR #36 found two documentation mismatches:

• Make the forbidden-claim scan genuinely case-insensitive while retaining binary-file exclusion.
• Clarify that the recovery verifier runs the isolated test service, while its own SQL never targets test databases.

Validation:

• bash -n script/verify_recovery.sh
• git diff --check
• Markdown link and anchor audit: 23 files, zero failures
• Corrected forbidden-claim scan: 26 hits, all explicit negations or limitations
• docker compose run --rm --build test bundle exec rspec spec/docker_compose_spec.rb: 54 examples, 0 failures