v0.2.2: docs(readme) + fix(release): README refresh + npm-publish OIDC fix (#44)

* docs(readme): refresh for public release — published SDKs, full contract set, accurate limitations

- Note the repo is public and the SDKs/node releases ship (npm @querais/sdk, PyPI querais,
  Releases archives); add `pip install querais` / `npm i -g @querais/sdk` install commands.
- Fix the Deployed contracts table: it had stale pre-Stage-B addresses and was missing 3
  contracts. Now matches the committed manifest (full 7-contract Stage-B set, incl.
  DisputeResolution, ProtocolTreasury, StakingRewards).
- Reconcile stale "deferred" claims: Slither runs in CI (non-gating); Layer-A semantic
  verification exists but is operator-gated and gateway-centralized.
- Drop an unverified "transparent proxies" claim (the testnet deploy is direct).
- Add a "What's not built yet (limitations)" section spelling out what the system does and
  does not include yet.

https://claude.ai/code/session_01ToifdKyJh5Zih6rz2abVfK

* fix(release): force npm token auth, not OIDC, in the publish step

The v0.2.1 release run failed at `npm publish`: enabling `id-token: write`
for PyPI Trusted Publishing made pnpm 11.5 auto-attempt npm OIDC trusted
publishing for @querais/*, which isn't configured — the token exchange 404'd
and the publish failed (so PyPI + the draft release were skipped, nothing
published).

Clear ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN for the npm step only, so pnpm
authenticates with NPM_TOKEN. The PyPI step still sees the OIDC env and
publishes via Trusted Publishing.

https://claude.ai/code/session_01ToifdKyJh5Zih6rz2abVfK

---------

Co-authored-by: Claude <noreply@anthropic.com>