Align public claims, licensing metadata, and adoption documentation

[Copilot]

The repo’s public surface was overstating evidence, mislabeling the current license, and drifting out of sync with the actual tree and scanner behavior. This PR tightens current-facing claims, adds an execution-grade remediation playbook, and removes tracked extension artifacts that should be reproducible rather than vendored.

• Public positioning and claim cleanup

  • Reframed README.md around Guardmarly’s strongest differentiator: authorization / IDOR-style analysis.
  • Removed unqualified current-facing claims like 100% CVE recall, 0% false positives, only free SAST, and blanket offline language.
  • Added explicit scope/limitations and a cleaner split between local CLI behavior, GitHub Action behavior, and the hosted/demo surface.

• License truthfulness

  • Stopped describing the repo as MIT in active package/docs metadata while the on-disk LICENSE is non-standard.
  • Updated pyproject.toml to reference the license file directly and removed the false MIT classifier.
  • Replaced license wording in README/extension docs with factual “custom / non-standard license” language.

• New remediation and evidence docs

  • Added DEEPSEEK_V4_REMEDIATION_PLAYBOOK.md as a detailed agent-ready execution brief.
  • Added CLAIMS_AND_EVIDENCE.md to define how performance/accuracy claims must be scoped and reproduced.
  • Added MIGRATION_FROM_ANSEDE.md to separate verified naming history from owner-confirmation items.
  • Added CONTRIBUTING.md with contribution and evidence expectations.

• Metadata and docs synchronization

  • Updated action.yml, VS Code extension docs/metadata, SECURITY.md, AGENTS.md, and selected .github docs to match the current repository state.
  • Corrected stale assumptions around license, supported surfaces, repo contents, and hard-coded counts.
  • Added a note in CHANGELOG.md clarifying that older benchmark language remains historical release context, not current evidence policy.

• Repository hygiene

  • Removed tracked vscode-extension/node_modules, compiled vscode-extension/out, and the checked-in .vsix package from version control.
  • Kept extension manifests/lockfile intact so the extension remains reproducible from source.

Example of the README/metadata shift:

Before:
"The only free SAST with built-in IDOR detection. 100% CVE recall. Fully offline."

After:
"Guardmarly focuses on missing object-level authorization checks (IDOR / broken access control) and related security findings across supported languages."