chore(audit): add Nobulex (Security) + correct BenchClaw caveat

- Add Nobulex to Agent Security with ⚠️ Unverified tag. Strong signal:
  bilateral receipt primitive merged into Microsoft AGT (#1302, #1333).
  Caveats noted: 15+ parallel awesome-list submissions, npm download
  claim (4500) doesn't match registry data (~19/month).

- Correct BenchClaw caveat: previous text said '7 of 8 lists rejected'
  but eudk/awesome-ai-tools#229 was actually merged. Updated to factual
  'one merged, rest pending or declined'.

Refs: #8, #12

Author: Zijian-Ni

README.md

@@ -453,6 +453,7 @@ Entries may carry one or more status tags so readers can judge maturity at a gla
 - [AgentDojo](https://github.com/ethz-spylab/agentdojo) - 🆕 ETH Zürich research benchmark for evaluating prompt-injection attacks and defenses against tool-using LLM agents. ![GitHub stars](https://img.shields.io/github/stars/ethz-spylab/agentdojo?style=flat-square)
 - [ModelScan](https://github.com/protectai/modelscan) - Scan ML model files (Pickle, PyTorch, TF) for serialization-based code-execution attacks. ![GitHub stars](https://img.shields.io/github/stars/protectai/modelscan?style=flat-square)
 - [PyRIT](https://github.com/Azure/PyRIT) - Microsoft's Python Risk Identification Tool for generative AI — automated red-teaming framework. ![GitHub stars](https://img.shields.io/github/stars/Azure/PyRIT?style=flat-square)
+- [Nobulex](https://github.com/arian-gogani/nobulex) - ⚠️ **Unverified.** Cryptographic receipts for AI agent actions (Ed25519 dual signatures, hash-chained audit logs). MIT. Bilateral-receipt primitive [merged](https://github.com/microsoft/agent-governance-toolkit/pull/1333) into Microsoft's Agent Governance Toolkit (PRs #1302, #1333). Same submission sent to 15+ awesome lists in parallel; submitter's claim of "4,500 npm downloads" doesn't match registry data (`@nobulex/mcp-server` ~19/month at audit time). Listed for visibility on the strength of the Microsoft adoption. ![GitHub stars](https://img.shields.io/github/stars/arian-gogani/nobulex?style=flat-square)
 
 ## 🔍 RAG & Knowledge
 
@@ -692,7 +693,7 @@ Entries may carry one or more status tags so readers can judge maturity at a gla
 - [Agenta](https://github.com/agenta-ai/agenta) - 🆕 Open-source LLMOps platform combining prompt playground, prompt management, evaluation, and observability. ![GitHub stars](https://img.shields.io/github/stars/agenta-ai/agenta?style=flat-square)
 - [LangSmith SDK](https://github.com/langchain-ai/langsmith-sdk) - Official client SDK for LangChain's hosted observability platform. ![GitHub stars](https://img.shields.io/github/stars/langchain-ai/langsmith-sdk?style=flat-square)
 - [AutoEvals](https://github.com/braintrustdata/autoevals) - Standalone library of best-practice LLM eval scorers (factuality, JSON validity, semantic similarity, etc.) by Braintrust. Drop-in for any framework. ![GitHub stars](https://img.shields.io/github/stars/braintrustdata/autoevals?style=flat-square)
-- [BenchClaw](https://github.com/Agnuxo1/benchclaw) - ⚠️ **Unverified.** Self-described multi-dimensional agent evaluation harness (17-judge tribunal, deception detectors, 10 scoring dimensions). Repo is single-maintainer with very low independent adoption; the same PR was rejected by 7 of the 8 awesome lists it was submitted to — listed for visibility, evaluate before relying on its scores. ![GitHub stars](https://img.shields.io/github/stars/Agnuxo1/benchclaw?style=flat-square)
+- [BenchClaw](https://github.com/Agnuxo1/benchclaw) - ⚠️ **Unverified.** Self-described multi-dimensional agent evaluation harness (17-judge tribunal, deception detectors, 10 scoring dimensions). Repo is single-maintainer with very low independent adoption; the same submission was sent to 8+ awesome lists in parallel — one was merged at [eudk/awesome-ai-tools](https://github.com/eudk/awesome-ai-tools/pull/229), the rest are pending or declined. Listed for visibility, evaluate before relying on its scores. ![GitHub stars](https://img.shields.io/github/stars/Agnuxo1/benchclaw?style=flat-square)
 - [PromptEden](https://www.prompteden.com) - ⚠️ **Unverified.** Commercial AI-visibility monitoring service — tracks how ChatGPT, Claude, Gemini, Perplexity, Copilot, and Grok describe brands and which competitors they recommend, refreshed daily across 9+ platforms. Submitted to 10 awesome lists on the same day — promising category but listed for visibility only, evaluate before purchasing.
 
 ---