docs: drop the scaffold-era warning from the root README

[rodrigobnogueira]

The root README's WARNING box still said "Pre-release scaffold (0.0.0)… the engine and the NestJS adapter are not implemented yet" — stale since 0.1.0 shipped. Replaced with the published-and-semver NOTE (npm links, changelog, docs site). No other content needed changing. Docs-only.

[github-actions]

📊 Coverage Report

Metric		PR	Base	Diff
Statements	████████████████████	897/897 (100%)	897/897 (100%)	⚪ 0%
Branches	████████████████████	151/151 (100%)	151/151 (100%)	⚪ 0%
Functions	████████████████████	50/50 (100%)	50/50 (100%)	⚪ 0%
Lines	████████████████████	897/897 (100%)	897/897 (100%)	⚪ 0%

---

_{Updated for 510bca6 | Compared against base branch}

[github-actions]

⏱️ Performance Report

✅ Tests	86 passed, 0 failed, 0 skipped
🧪 Suites	20
⏱️ Total step time	24.00s 🟢 -1.00s
⚙️ Test execution	19.51s 🟢 -821ms

🐢 Slowest test suites

#	Suite	Tests	Duration	vs Base
1	LockoutStore contract — postgres (pglite)	5	9.80s	🟢 -724ms
2	LockoutStore contract — sqlite (better-sqlite3)	5	21ms	⚪ ~0
3	MysqlLockoutStore (real drizzle-mysql2 builder, fake client)	5	9ms	⚪ ~0
4	@authlock/core acceptance (framework-neutral login flow)	2	4ms	⚪ ~0
5	lockout table schema parity	4	2ms	⚪ ~0
6	LockoutManager — configuration validation	7	2ms	⚪ ~0
7	LockoutStore contract — in-memory	5	1ms	⚪ ~0
8	InMemoryLockoutStore	6	1ms	⚪ ~0
9	deriveKeys	8	1ms	⚪ ~0
10	LockoutManager — basic lifecycle	4	1ms	⚪ ~0

🐌 Slowest individual tests

#	Suite	Test	Duration	vs Base
1	LockoutStore contract — postgres (pglite)	LockoutStore contract — postgres (pglite) creates, increments (advancing lastFailureAt), then resets after the window	2.55s	⚪ ~0
2	LockoutStore contract — postgres (pglite)	LockoutStore contract — postgres (pglite) reads a stored record, or null when the key is unknown	1.91s	🟢 -61ms
3	LockoutStore contract — postgres (pglite)	LockoutStore contract — postgres (pglite) counts concurrent increments exactly — no lost updates	1.81s	🟢 -199ms
4	LockoutStore contract — postgres (pglite)	LockoutStore contract — postgres (pglite) clears a single key	1.77s	🟢 -218ms
5	LockoutStore contract — postgres (pglite)	LockoutStore contract — postgres (pglite) clearExpired removes only records older than the cutoff and counts them	1.76s	🟢 -198ms
6	LockoutStore contract — sqlite (better-sqlite3)	LockoutStore contract — sqlite (better-sqlite3) counts concurrent increments exactly — no lost updates	9ms	⚪ ~0
7	MysqlLockoutStore (real drizzle-mysql2 builder, fake client)	MysqlLockoutStore (real drizzle-mysql2 builder, fake client) increment issues an atomic windowed upsert then re-reads the row	7ms	⚪ ~0
8	LockoutStore contract — sqlite (better-sqlite3)	LockoutStore contract — sqlite (better-sqlite3) creates, increments (advancing lastFailureAt), then resets after the window	7ms	⚪ ~0
9	@authlock/core acceptance (framework-neutral login flow)	@authlock/core acceptance (framework-neutral login flow) locks a brute-force loop after the limit, then recovers after cooloff	2ms	⚪ ~0
10	LockoutStore contract — sqlite (better-sqlite3)	LockoutStore contract — sqlite (better-sqlite3) reads a stored record, or null when the key is unknown	2ms	⚪ ~0
11	LockoutStore contract — sqlite (better-sqlite3)	LockoutStore contract — sqlite (better-sqlite3) clearExpired removes only records older than the cutoff and counts them	2ms	⚪ ~0
12	@authlock/core acceptance (framework-neutral login flow)	@authlock/core acceptance (framework-neutral login flow) exposes a semver-shaped version	1ms	⚪ ~0
13	MysqlLockoutStore (real drizzle-mysql2 builder, fake client)	MysqlLockoutStore (real drizzle-mysql2 builder, fake client) get returns the mapped record when present	1ms	⚪ ~0
14	MysqlLockoutStore (real drizzle-mysql2 builder, fake client)	MysqlLockoutStore (real drizzle-mysql2 builder, fake client) clear deletes by key	1ms	⚪ ~0
15	lockout table schema parity	lockout table schema parity postgres table has the expected shape	1ms	⚪ ~0

---

_{Updated for 510bca6 | Compared against base branch}

[github-actions]

🧠 Cognitive Complexity Report

Metric	PR	Base	Diff
Total complexity	64	64	⚪ 0
Max function complexity	11	11	⚪ 0
Functions measured	25	25	⚪ 0

🧩 Most complex functions

Function	Location	Complexity	Status
validateTiers	packages/core/manager.ts:27	11	🟢 OK
deriveKeys	packages/core/key.ts:26	8	🟢 OK
cooloffFor	packages/core/policy.ts:10	4	🟢 OK
evaluateRecord	packages/core/policy.ts:78	4	🟢 OK
mostRestrictive	packages/core/manager.ts:86	3	🟢 OK
LockoutManager.clearKeys	packages/core/manager.ts:221	3	🟢 OK
LockoutManager.applyFailure	packages/core/manager.ts:242	3	🟢 OK
effectiveWindowMs	packages/core/policy.ts:33	3	🟢 OK
InMemoryLockoutStore.clearExpired	packages/core/store/in-memory.ts:45	3	🟢 OK
LockoutManager.constructor	packages/core/manager.ts:126	2	🟢 OK

🧭 Cognitive complexity is reported as a review signal, not a merge gate. Prefer small, intention-revealing refactors when complexity rises.

---

_{Updated for 510bca6 | Compared against base branch}