docs(plugin,mcp,readme): the push monitor is consent-gated — say so where agents and operators read (PLAN-2613 S5, TASK-2620)

[xarmian]

PLAN-2613 S5 / TASK-2620 — the docs half of the release unit. Docs-only (plus the plugin version bump); the v0.15.0 release-notes Highlights are drafted in Pad as DOC-2802 per PLAYB-1160 step 2 and are not in this diff.

What this says, and where

• plugin/skills/pad/SKILL.md — the monitor section now states the consent gate up front (D1/D2/D4): nothing streams or listens until /pad:connect (arms locally; the monitor announces on connect) or a repo-level push.auto_arm = true (vetoable per user; an auto-arm monitor that exited does not restart mid-session); no machine-global always-on; no grandfathering (D6); and the D7 caveat on the record — an agent can arm from inside its own session, visibly; the gate protects sessions from the outside. Also tells the agent never to arm on its own initiative, and what a push with no accepting session actually does (broadcast publishes with delivered_sessions: 0; targeted miss skips the publish; only the web composer withholds).
• internal/mcp/instructions.md — a security note for MCP agents: what a push is, that it is consent-gated and self-addressed, that this connection cannot arm/receive/push (no push action in the catalog), and what to tell a user who asks to "push" something.
• README.md §Security — the operator-facing note: consent gate, self-addressed only, no grandfathering, the accepted caveat, and that a push can inject text but cannot click a permission prompt.
• plugin/.claude-plugin/plugin.json 0.3.2 → 0.3.3 — skill text changed (TASK-2591 precedent).
• plugin/monitors/monitors.json re-read against D7: already the gated form from S3; unchanged.

Evidence

• go build ./..., go vet ./internal/mcp/, go test ./internal/mcp/ ok (instructions.md is embedded); make lint 0 issues.
• Codex, docs diff: R1 found a P1 that was mine ("refused with honest counts" — the API publishes a broadcast with delivered_sessions: 0) plus three P2s (arming is local until announced; auto_arm veto / no mid-session restart; "no process" → "nothing streams"); R2a: two P2 wordings (broadcast vs targeted; CLI reports acceptance); R3: CLEAN, each claim confirmed at a file:line in handlers_push.go / cmd_push.go / arm_consent.go, and no contradiction with the connect/disconnect/status skills.
• Codex, DOC-2802 draft (audited as an untracked file, not in this diff): R2b found five ref/table mismatches, all corrected in the DOC — heartbeat phase-2 row now lifted verbatim from deployment.md; BUG-2779 described by its own title; MCP: pad_item create/update silently ignores valid fields.status / fields.priority writes (no error, updated_at still bumps) #1066 cited via PR fix(mcp): accept a fields object on pad_item create/update; reject undeclared input keys (#1066) #1159; PLAN-2656 cited by its tasks; "two rollouts, three flags".

Release-bound

The "since v0.15.0" phrasing is forward-looking on purpose: nix/package.nix still says 0.14.0 and the tag does not exist. This PR must merge before the 0.15.0-rc.1 cut (PLAYB-1160), which owns the binary version bump; it must not ship alone.