docs(cost): clarify ChatGPT allowance semantics

[sylvesterkaczmarek]

Summary

Clarify what Codex Security's USD cost estimate and --max-cost mean when a scan uses ChatGPT authentication.

Addresses the remaining documentation/UX portion of #29.

Reproduction / evidence

Issue #29 describes a ChatGPT-authenticated scan where the CLI showed an estimated USD cost while the user's ChatGPT Codex allowance changed independently. A maintainer later confirmed that the polling backlog was fixed separately, while the distinction between API-equivalent USD estimates and ChatGPT allowance remained unresolved.

Current documentation says that --max-cost limits estimated USD model cost, but does not explain that this is a pricing-based estimate rather than ChatGPT plan-allowance telemetry.

Root cause

The CLI exposes one model-cost estimate derived from observed token usage and pricing. The documentation did not state the boundary of that metric when authentication comes from a ChatGPT subscription.

Fix

The root README now states that:

• the displayed USD amount and --max-cost are API-equivalent model-cost estimates based on observed token usage and model pricing;
• with ChatGPT authentication, that amount is not a measurement of ChatGPT plan allowance;
• the CLI does not show remaining ChatGPT allowance;
• --max-cost does not cap that allowance;
• an active request may not yet be represented until new usage data is observed.

This deliberately does not claim that Codex Security can retrieve plan-allowance telemetry that it does not currently expose.

Tests / validation

Documentation-only change: 7 added lines in the root README. The branch is based directly on current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba and is not behind it.

No runtime behavior or generated artifacts are changed.

Risk

Low. This is documentation-only and narrows an ambiguous interpretation of the existing cost display without changing budget enforcement.