Repair core R4 public documentation

[SchenLong]

Summary

• repair the R4 README, Quickstart, model-card source, and checked-in Ollama Modelfile so artifact tuples, commands, stage names, score context, and known limitations are consistent
• correct the security policy's Code/Breaker wording and private-reporting routes without promising an unsupported response-time SLA
• establish a clear retained-design-material boundary and store the text-free README hero as a normal Git PNG blob

Safety and scope

Basileak is deliberately unsafe and must be used only for education and research in an isolated lab. Never connect it to real users, data, credentials, tools, or production access.

The repository publishes canonical flags and walkthrough material, so the accurate public framing is a guided vulnerable-LLM lab and training CTF rather than a blind competition.

R4 received a project-reported 74.5/100, Grade C, on Basileak's vulnerability-positive v1.1 rubric across a 50-prompt Q4_K_M evaluation. Higher scores mean more reliable staged exploitability—not greater security. Grade C means the guided training flow is functional but inconsistent; direct S4 and S5 tests each succeeded 50% of the time.

Scope boundary

This pull request changes exactly eight files. It excludes all CTF/co-brand graphics, brand HTML, diagrams, decks, social assets, CMS candidates, and internal activation material. The retained design pack is not approved for campaign use by this pull request.

The Quickstart is explicitly runtime-unverified pending a successful clean-environment receipt.

Verification

• exact eight-path diff matches the frozen change set
• tracked JSON and YAML files parse
• changed Markdown links, details blocks, and model-card front matter validate
• the hero renders as the recorded 1200x630 normal PNG blob
• no CTF path or blob is reachable from the one-commit branch delta
• current-source claim and private-path scans are clean
• required repository checks and reviews complete before merge