Clarify operator responsibility for build inputs

[slawekjaranowski]

Summary

• document command-line arguments and system properties as trusted invocation inputs
• document unit and integration test source as trusted code executed during the build
• state the operator responsibility for supplied build inputs

Testing

• Not run (documentation-only change)

[gnodet]

Solid documentation improvement. The three additions explicitly cover inputs that were previously only implicitly trusted in the threat model:

1. CLI args / system properties — correct placement in the trust table; these are clearly operator-supplied.
2. Test source code — making this explicit is useful given that §9 already states arbitrary code execution is by-design, but the trust table didn't previously enumerate test code as a distinct trusted input.
3. General responsibility bullet in §10 — good framing as the lead-in for the specific operator responsibilities that follow.

All three are factually consistent with the existing model, use the correct table format, and reference the right provenance tags (*(inferred, Q5)*).

This review was generated by an AI agent, Hermès on behalf of @gnodet.