docs: rlm-kit is a git source, not an editable path dep

CLAUDE.md still described the rlm-kit dependency as an "editable path dep",
but pyproject.toml sources it via git (commit-pinned in uv.lock) and the CI
relies on that. Correct the description so code and docs agree.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: qazbnm456

CLAUDE.md

@@ -1,7 +1,7 @@
 # cve-reverser — agent guide
 
 Reverses publicly disclosed WordPress plugin CVEs from their patches into a local-lab PoC + a Nuclei
-detection template, via an `rlm-kit` RLM harness. A downstream consumer of `rlm-kit` (editable path dep)
+detection template, via an `rlm-kit` RLM harness. A downstream consumer of `rlm-kit` (git source, commit-pinned in `uv.lock`)
 — it follows a set of hard-won conventions on purpose (don't re-derive them
 worse). See `README.md` for the roles/pipeline and rlm-kit's **"Building a consumer"** for the extension
 contract (base/wrap, the promotion rule, the rollout-vs-reward stage boundary) this project lives within.