docs: compliance-claim discipline pass (#122)

[sergeyenin]

Summary

Compliance-claim discipline pass (proof-bar area 4), now unblocked by the merged LIMITATIONS.md (#117). Removes compliance-outcome language from public docs and enforces the rule going forward.

Style rule + policy

• Adds a "Compliance-claim discipline (required)" section to CONTRIBUTING.md: always "supporting controls / evidence for <article>", never "GDPR compliant" / "makes you compliant" / "ensures/guarantees compliance". Links to LIMITATIONS.md and internal/compliance/mapping.go.

Docs audit (outcome language -> supporting-controls language)

• docs/ADOPTION_SCENARIOS.md: "Compliant" framing -> "Governed"; "now GDPR + NIS2 compliant" -> "has supporting controls and evidence for GDPR + NIS2"; "prove compliance" -> "show auditors evidence".
• docs/VENDOR_INTEGRATION_GUIDE.md: title "Making Vendors Compliant" -> "Governing Vendors"; closing line no longer claims Talon "makes them compliant" and notes the determination stays with the data controller.
• internal/cache/README.md: "GDPR Article 17 compliant" -> "supports GDPR Article 17 controls".
• internal/pack/wizard.go: pack description "GDPR-compliant" -> "supporting controls for GDPR".

Quoted compliance-officer / vendor dialogue is intentionally kept — it reinforces the skeptical-buyer message and is not a Talon claim. Provider metadata fields named GDPRCompliant (self-declared, "verified only") are left as-is.

CI guard (optional per issue, included)

• scripts/check-claim-discipline.sh fails on outcome phrases ("makes you compliant", "guarantees compliance", "fully compliant", "N days to compliant", ...). Wired into the Docs workflow. Excludes LIMITATIONS.md / CONTRIBUTING.md, which quote the banned phrases as negative examples.
• Also added LIMITATIONS.md to the markdown link-check scope.

Closes #122.

Test plan

• bash scripts/check-claim-discipline.sh passes on the current tree.
• Guard regex catches "makes you compliant" / "N days to Compliant" / "fully compliant" / "guarantees GDPR compliance" and allows quoted dialogue + "supporting controls for GDPR Art. 32".
• go build ./internal/pack/... succeeds.
• Docs workflow (link check + claim guard) passes in CI.

---

Note

Low Risk
Documentation and contributor guidelines only, plus a non-runtime docs CI script; no product behavior or security paths change.

Overview
This PR tightens compliance-claim discipline across public-facing material: docs and copy must describe supporting controls / evidence for specific articles, not compliance outcomes.

Contributor policy: CONTRIBUTING.md adds a required section (always pair features with articles; never "GDPR compliant" / "makes you compliant" / guarantees). It points to LIMITATIONS.md and internal/compliance/mapping.go.

Wording pass: Adoption and vendor guides reframe "compliant" paths as governed, describe post-Talon state as controls + evidence (not "now compliant"), and clarify the data controller owns the legal determination. internal/cache/README.md and the hidden Flowise pack string in internal/pack/wizard.go drop outcome-style GDPR claims.

CI enforcement: New scripts/check-claim-discipline.sh greps public markdown for banned outcome phrases (with exclusions for LIMITATIONS.md / CONTRIBUTING.md negative examples). The Docs workflow runs it and adds LIMITATIONS.md to markdown link-check file-path.

^{Reviewed by Cursor Bugbot for commit 4adcf49. Configure here.}