[jacobyoby]

Summary

Docs-only accuracy pass against main @ c9e146c. No code or #39 changes.

Fixes

• SECURITY.md / CONTRIBUTING.md — Outbound traffic is no longer described as IMAP-only. Docs now match the allowlisted Google/Microsoft OAuth2 token refresh in src/nodary/auth/oauth2.py (and the exception already documented in README).
• docs/SECURITY-BOUNDARIES.md — Replaces "No outbound requests after install" with the same IMAP + allowlisted token-endpoint rule; drops a stale index.html line-count claim (file is 617 lines).
• docs/DESIGN.md — Status bumped from v0.3.0 to v0.3.1 to match pyproject.toml / CHANGELOG / TODO.
• docs/TODO.md — Scoring engine listed as v1.1.0 (ENGINE_VERSION in src/nodary/scoring/registry.py). Held Generate confusables from vendored UTS #39 data #39 note left untouched.
• README.md / CHANGELOG.md — Foundation display name normalized to JACOBRAKAI FOUNDATION (heading + donate link text). Adds uv run nodary status next to rebuild.

Test plan

• Skim the seven doc diffs
• Confirm Generate confusables from vendored UTS #39 data #39 wording in docs/TODO.md is unchanged
• No code/test changes expected