docs: document model gotchas and drop stale version example

[Chemaclass]

What

Surgical docs pass — no prose churn.

• docs/behavior.md — new Gotchas section (+ TOC entry) documenting three real boundaries of the flat, URL-driven model, framed as by-design:
  • a dependency's identity is its filename → same-basename URLs collide in a directory
  • the lockfile pins the source URL, not a checksum (integrity is opt-in via #sha256=)
  • no transitive resolution — list the full set yourself
• docs/api.md — dropped the hardcoded 0.6.0 from the bashdep::version example so it stops drifting every release.
• docs/README.md — index Behavior line now lists checksum + parallel + gotchas (was only lockfile/dev-deps/error handling).
• README.md — matched the Behavior blurb for consistency.

Why

The gotchas are the questions a user hits first (filename collisions, "does the lock verify integrity?"). Documenting them up front beats a surprise. The version example was already stale (0.6.0 vs shipped 0.7.0).

Test plan

Docs-only. make lint (editorconfig) green; all edited lines within the 100-char cap.