README: state the scope caveat before the first big claim, not 100 lines later

[higagan]

From a 4-persona fresh-eyes UX review. Highest-leverage change — all four reviewers converged on it.

Problem

The headline (README line 8) promises prompt-injection defense. The honest admission that the default engine is a three-keyword substring filter lives in Limitations at line 113 — ~100 lines below the claim. A skeptic reads that gap as a walk-back:

"honesty that arrives after the claim reads as a walk-back; honesty that arrives before it is credibility."

This is the biggest credibility risk in a live demo: it invites the "this is a profanity filter with three entries" takedown before the reader ever reaches the caveat.

Fix

Insert one sentence immediately after The Solution (after line 20):

The interception point and the policy protocol are the product; the built-in SensitiveDataFilter is a demo default that matches three literal keywords — you write the policies for your own threat model.

Done when

• The "default is a demo filter" framing appears above the fold, before the first runnable example
• The fuller Limitations section (line 113) stays, but is no longer the first place a reader learns this