Publish the first measurement, and scope the README to it (TASK-12)

[axazeano]

Nothing in the README said how well the reviewer works, so every claim about it
was an opinion — and the sample output was invented, down to a src/cart.py
that exists nowhere. This adds the first measurement, the ground it stands on,
and rewrites the claims that no run had demonstrated.

What is here

truth.toml fixes 31 defects of nextcloud/ios#4091
and 6 claims proven false. Every entry carries the evidence it was established
by, so a reader can disagree with a specific line rather than with the file.
origin separates the 16 entries set by hand before any run from the 15 added
by verifying a model's output against the code.

docs/measurements.md records eight series — three models, four checklist
sizes, three reasoning and sampling settings — with recall, false positives,
what the judge removes, and what each run cost, plus the settings behind every
number.

README.md carries two of those charts, a real run in place of the invented
one, and four rewritten claims.

What the numbers say

Recall against the 31 known defects runs from 6% (nemotron-lightning, 8 items)
to 71% (Claude Opus 5). Verified false positives sit between 2% and 12%, drawn
as ranges because 2 to 15 findings per series remain unadjudicated. They are not
flattering and are published anyway: a starting line to be moved, not a claim.

Two conclusions worth a reviewer's attention. Model choice moved recall far more
than any knob — checklist size, reasoning depth and sampling all stayed inside a
few points. And the class the tool misses most is the one the reference pre-pass
already computes and prints into the prompt: a symbol that resolves nowhere.

Claims that were rewritten

• The judge was described as though surviving it meant being right. It removes
  6% to 54% depending on how noisy the finder is, and what survives has a
  false-positive rate of its own.
• "Does not replace a human reviewer" now states the size of the gap.
• A new entry says the tool keeps no state between runs, so in CI it repeats the
  same findings on every push — the usual reason such bots get switched off.
• Scope is stated: findings follow the change by consequence, not authorship, so
  a call the branch now makes into already-broken code is in scope.
• Reproducing a human review is explicitly not the goal — agreement with a
  reviewer would measure similarity, not correctness.

What a reviewer should know

It is one merge request, so n = 1 at the repository level. Half the truth set
is not independent: 15 of 31 entries were added by verifying one model's output,
so that model is graded partly on ground it defined — the honest cross-model
comparison uses the 16 marked origin = "manual". Opus ran without the judge,
as a ceiling rather than a configuration of this tool. And severity is not yet
stable enough to gate a pipeline on: the same defect came back blocker in one
run and minor in the next.

The raw runs behind these numbers are not in the repository. If they should be,
say so and they can land as a separate change — trimmed, and without the config
files that have no business in an archive.

Closes TASK-12.