docs: tighten wording, soften node capability claims, link architecture to code

- Remove the node capability paragraph from README; soften "pure collector"
  and "no self-update" statements in docs, AGENTS.md and READMEs
- architecture.md: drop scalability goals, design decisions and open items;
  add a component-to-code table and code links
- Replace rhetorical contrasts in security docs with direct statements
- AGENTS.md: add project mental model, change map and writing style rules

docs/design/analysis.md

@@ -129,7 +129,7 @@ chunk 入库 ─┬─> 流式路径：按 1s 桶计算累加器 → 热层环
 
 每个模型的输出都附带：各指标的样本量、`estimated` 标记，以及局限说明，例如：
 
-- 模拟的只是流量特征，不是真实协议；
+- 只模拟流量特征，不实现真实协议；
 - 测量端口与真实服务端口不同（`port_differs_from_service`，默认端口 7443/7444 时总会出现）。
 
 ## 9. 项目结构