Document server-owned identity binding + fix README test count (252→256)

[Lvvphole]

What

Documentation-only follow-up to PR #10. The runtime spine + P1 identity-binding code merged with #10 (squash 08b7ea1), but this README update was pushed to the branch after #10 was merged/closed, so it never landed on main. This re-applies it cleanly off current main.

Changes (README.md only)

• Document the execute endpoint's server-owned identity binding: the URL run_id is authoritative; a body run_id/task_id that diverges from the URL or registered manifest is rejected 422 and never executes; an empty run_id is adopted from the URL.
• Add a "Notable invariants" line for the identity-mismatch rejection (no execution, no artifacts under a divergent id).
• Fix the stale test count 252 → 256 (status table, run command, repo-layout tree) — main currently understates it.

Verification

cd backend && python -m pytest -q   # 256 passed (matches the updated README)
git diff --check                    # clean

No code or test changes — README only.

🤖 Generated with Claude Code

---

Generated by Claude Code