tidy-pipeline: a package doc justifying a scan that is gone

[dinstein]

Nightly tidy pass over internal/pipeline (2026-08-10 04:47 round).

• Pass C — the package doc said "Success and error branches share
  defend_and_shape (docs/flows.md: a malicious server must not bypass
  scanning by answering with a JSON-RPC error)". There is no scanning.
  Everything else in the tree already records that: shape.go says what
  is left "inspects nothing and decides nothing about a call",
  docs/modules/dataplane.md says the scans and their ordering rules went
  with the governance surface, and ShapeFunc — three paragraphs below,
  in the same file — calls the stage "defend_and_shape, which no longer
  defends, only shapes".

  So the place a reader meets first was the last one still naming a
  defence the code does not have, and naming it as the *reason* both
  branches share a stage. The reason is now the one `architecture.md` §5
  already gives: the counter advances either way, which is what the
  stdio/HTTP gate-count parity assertions compare, while only the success
  branch is shaped because an error carries no payload to bound.
  

• Pass A / Pass B — nothing cleared the bar. Execute's chain is five
  lines, ScopeAllows and both gates document their failure directions,
  and Counters()' type assertion is nil-safe on the documented
  NewWithGates(_, nil) shape.

CallRequest.InputSchema is unread and says so, with the argument for leaving
it (deleting it should be a decision, not a side effect) — left alone, same
call as session.ClientCaps.ToolsListChanged two rounds ago.

Comment only; the prose docs needed no edit, being right already.
Verification: make ci green.