docs: align Flow claims and limits with current contracts

[abrichr]

PR #401 moved Flow's lifecycle to admission-derived product state. PR #404 wired the appliance tiers for resume, and PR #408 made the egress posture sticky before execution. Eight useful pieces from #381 still needed a current branch.

Flow's opening now names it as OpenAdapt's demonstration compiler and governed runtime. The safety text records uncertain delivery as RECONCILIATION_REQUIRED with no blind retry. The claims registry keeps required-CI evidence tiers separate from release and workflow admissions.

The geometry text stays inside the evidence. Browser attach can start an exact epoch after a stable viewport change; native conversion needs valid mapping metadata and a fixed output viewport, while RDP and Citrix can rebaseline only between actions.

Capture ownership now points to openadapt-capture, while the remaining edits state the identity and operator-authentication requirements, describe current VLM wiring across replay, resume, and attended execution, and refresh the generated claim artifacts. This PR doesn't change release state or publish a package.

Checks:

• python scripts/check_consistency.py
• python scripts/validate_claims.py --check --structure-only
• python scripts/check_release_consistency.py
• 160 focused docs, claims, Capture adapter, VLM, drift, and backend-capability tests
• git diff --check

Retitle

The branch was called feat(cli): make rejected-write simulation an advanced check, but the diff is ten docs and claims files with no CLI change. Flow
squash-merges, so the title becomes the commit message. It now reads
docs: align Flow claims and limits with current contracts.

The one conflict, in README.md

Main describes the --break-it demo as ending with the engine HALTS. This
branch rewrote that to say the runtime returns RECONCILIATION_REQUIRED. Both
are true and they are not the same field, so both are kept.
tests/e2e/test_tutorial_break_it_e2e.py pins the pair directly:

assert broken.execution_outcome == "HALTED"
assert broken.transaction_outcome == "RECONCILIATION_REQUIRED"

It also pins the two follow-on claims this branch adds: run-broken/REPORT.md
leads with HALTED, and a halted run writes no receipt. Worth knowing that the
unit test tests/test_cli_tutorial_break_it.py fakes the report object, so it
would not have caught a wrong outcome here. The e2e test is the one doing real
work, and it is the one backing the new text.

public-artifacts.json regenerates byte-identical from
python scripts/check_release_consistency.py --write-public-artifact-inventory,
so the pinned hashes hold against this base and the wheel gate is satisfied.

For anyone tracing this branch: #413 carries these same four commits as part of
the 1.34 stack, records a tested release order, and stays unmerged by its own
instruction. This PR is the one that lands the docs half.