README honesty pass + add a Privacy section (data flow, cache, recruiter-mode legal note)

[AdvancedUno]

Problem

The README oversells what is actually fetched, and it has no privacy section at all — a serious gap for a tool that sends resume text to a third-party LLM and caches it on disk. Trust is this product's whole value proposition; over-claiming undermines it.

Concrete mismatches between README and code today:

• "Multi-source fusion — GitHub + Scholar/arXiv + Codeforces/LeetCode + Kaggle" — but Codeforces/LeetCode are recorded, not fetched (see Implement Codeforces (+ best-effort LeetCode) competitive-programming collector #21), Kaggle is handle-only, ORCID/arXiv are unimplemented (Implement ORCID + arXiv publication collectors #7), and Scholar relies on scholarly, which Google actively blocks.
• The bigtech agent is described as leaning hardest on DSA/LeetCode while being unable to fetch LeetCode.

Proposal

1. Honesty pass on the feature list. Rewrite the "multi-source fusion" bullet to state what is reliably fetched today (GitHub, portfolio/web, best-effort Scholar) vs. recorded-but-not-fetched (Codeforces/LeetCode handles) vs. resume-derived (arXiv/ORCID). Keep the roadmap items as roadmap.

2. Add a ## Privacy section covering:

• Resume text is parsed by the selected LLM provider (Gemini by default) — treat it as data sent to that provider under their policy.
• External signals are fetched locally and also sent to the LLM; nothing goes to a HireGauge server.
• Responses are cached locally (default path once Security: candidate PII committed in .hireme_cache/ (HireMe -> HireGauge rename leftover) #16 lands); hiregauge cache clear wipes it; HIREGAUGE_CACHE_DIR overrides the location.
• Recruiter mode (--mode recruiter) reframes output for a hiring reader — using it to evaluate other people is a regulated use (e.g. NYC Local Law 144 bias-audit, EU AI Act); the user is responsible for compliance.

3. Add a docs regression test in tests/test_docs.py asserting the README doesn't claim Codeforces/LeetCode stats are "fetched" until they are.

Acceptance criteria

• Feature list matches implementation reality.
• ## Privacy section added covering LLM data flow, local cache, and recruiter-mode legal note.
• tests/test_docs.py guards against re-introducing the misleading "fetch(es) codeforces/leetcode" phrasing.

Files

• README.md
• tests/test_docs.py

Related: #9 (percentile honesty), #21, #7, #17 (recruiter mode).