Improve typegap README safety boundaries

[rogerchappel]

What changed

• Clarifies that reports need review and should not include secrets or private data.
• Kept the change scoped to package trust, CI, or README safety boundaries only.

Why it matters

This makes the repo easier for developers and agent workflows to install, audit, and verify without guessing where the source, issue tracker, safety limits, or CI checks live.

Verification

• rg -n "Limitations and Safety|Safety Notes|Limitations" README.md where README changed: pass
• npm run check: pass where defined after npm install --package-lock=false
• npm test: pass where defined after npm install --package-lock=false
• npm run smoke: pass where defined after npm install --package-lock=false

Remaining limitations

• No release was tagged or published.
• Commit count: 1.
  Commit summary:

3dc3d82 Document limitations and safety boundaries