fix: cardinality guardrails, query cost bounds, honest visuals, English SKILL.md

- hard guard: no group-by above 300 distinct values; topk bounds every grouped
  panel (teams, services, agents, tools, log volume)
- maxDataPoints on all timeseries — bounded query cost on long ranges
- README images explicitly labelled as illustrations, with 'make demo' for the
  real rendering (credibility: a hand-drawn SVG must never read as a screenshot)
- SKILL.md fully in English (agent playbook is the shipped artifact; French
  version kept in docs/SKILL.fr.md)
- audit harness 41 → 45 checks

Author: alebgl77

CHANGELOG.md

@@ -18,8 +18,13 @@
 - Avertissement si aucun contact point n'est configuré (alertes sans destinataire).
 - Workflow mensuel de fraîcheur du registre de prix.
 
+### Hardened
+- **Cardinalité** : garde-fou dur (aucun group-by au-delà de 300 valeurs distinctes) et bornage `topk` sur tous les panels groupés (équipes, services, agents, outils, logs) — un graphe à 300 courbes est illisible *et* lent.
+- `maxDataPoints: 500` sur toutes les séries temporelles : coût de requête borné sur les longues plages.
+- Visuels du README explicitement étiquetés « illustration, pas capture » ; `make demo` fournit le rendu réel.
+
 ### Changed
-- Description du skill en anglais (le déclenchement suivait mal les requêtes anglophones) ; version française conservée dans `docs/SKILL.fr.md`.
+- SKILL.md intégralement en anglais (le déclenchement suivait mal les requêtes anglophones) ; version française conservée dans `docs/SKILL.fr.md`.
 - Harnais d'audit : 27 → 41 contrôles.
 
 ## [1.1.0] — 2026-07-23

README.md

@@ -37,7 +37,7 @@ python3 scripts/visual_audit.py --dashboards generated_dashboards  # ③ prove i
 ```
 
 <div align="center"><img src="docs/assets/dashboard-finops.svg" alt="Generated FinOps dashboard" width="100%"/>
-<sub><i>The FinOps blueprint — costs composed from a 30-model price registry, split by provider sovereignty (EU / US / Asia).</i></sub></div>
+<sub><i><b>Illustration</b> (hand-drawn SVG, not a screenshot) of the FinOps blueprint: cost composed from a 30-model price registry, split by provider sovereignty. For the real thing on real data, run <code>make demo</code> — it boots Grafana + Prometheus + a synthetic LLM workload and deploys these dashboards for real in about a minute.</i></sub></div>
 
 ## Why this is different
 
@@ -49,7 +49,8 @@ Most "LLM dashboards" are static JSON that assume your metric names. This is a *
 4. **Governance is observable.** The EU AI Act dashboard maps articles (12, 26§6, 50, 73) to live signals: logging evidence, retention posture, incident watch, an auto-built model inventory with sovereignty and GPAI flags, and the post-Digital-Omnibus timeline.
 5. **Verified by eye, not just by API.** HTTP 200 proves the JSON was accepted — not that the render is right. After deploy, `visual_audit.py` captures every panel (native Grafana renderer, Playwright fallback) and an AI vision pass checks scale plausibility, "No data" panels, p50>p95 impossibilities, cross-panel coherence — then loops remediation (max 2 iterations, then an honest report).
 
-<div align="center"><img src="docs/assets/architecture.svg" alt="Pipeline" width="100%"/></div>
+<div align="center"><img src="docs/assets/architecture.svg" alt="Pipeline" width="100%"/>
+<sub><i>Diagram, not a screenshot. Every box is a script in <code>scripts/</code>.</i></sub></div>
 
 ## The six blueprints