Doc overstatement: credential-gate override "every use is logged" is best-effort (README.md:367 + zh:252)

[F-e-u-e-r]

Follow-up from #118 (the #104 doc-sync fix), surfaced by the cross-family
review's twin-sweep. Outside #104's blast radius, so tracked separately (not
folded into the PR 2 architecture-contract work).

The overstatement

README.md:366-367 (credential-destruction gate section):

The override is friction plus an audit log, not proof of consent — every use
is logged.

"every use is logged" reads as a guarantee, but that gate's logging is
best-effort: hooks/gate-credential-destruction.py::_log (:109) wraps its
write in except Exception: (:115) and swallows the failure.

This is the same class #104 item (c) fixed for the advisory log. #118 softened
the shared README auditability sentence (~README.md:431, and the zh mirror) to
"these log writes are best-effort…", but did not touch this separate
credential-gate sentence — different hook, different section, not named in #104.

The zh-Hant twin is README.zh-Hant.md:252 (憑證閘段落: "override 是摩擦力加稽核
紀錄,不是同意的證明——每次使用都會留 log").

Suggested fix

Qualify both README.md:367 and README.zh-Hant.md:252 the same way #118 did:
keep the intent (there IS an audit log), add that the write is best-effort (a
failed log write is silently dropped and never blocks the gate). Docs only, no
behaviour change — same "code is authoritative, soften the docs" disposition as
#104 (c). Re-confirm line numbers against HEAD before editing.

[F-e-u-e-r]

Terminal disposition: DOCS-CORRECTNESS REPAIRED — closed via #222 (merge commit 0e92d4a).

The docs overstatement is corrected in both README mirrors, in parity: the credential-gate override section no longer claims "every use is logged" / 「每次使用都會留 log」; it now states the actual contract — every approved override attempts to append an audit event, the log write is best-effort, a failed write is silently dropped, and a logging failure never blocks the hook.

Runtime unchanged throughout: hooks/gate-credential-destruction.py is byte-identical before and after the fix (its _log() still swallows exceptions by design), and the code remained authoritative — the docs moved to match the code, not the reverse. The README's pre-existing shared auditability paragraph, which already stated the best-effort semantics, is untouched.

This issue's original line references (EN 367 / zh 252) had drifted to EN 406 / zh 286 by fix time; both preimages were verified present exactly once before editing.