docs: fix stale pipeline step count, rule count, and MCP command syntax

[cyyever]

Summary

Doc verification found 3 factual errors:

• plugins.md: Referenced "14-step pipeline" but engine has 17 steps since security: add env var poisoning rule, update CVE tracker to 50 #121/fix: harden Layer0-DLP, content analysis, and git config protection #130/refactor: move detect-exfil-redirect from regex to shell AST detection #133
• README.md: Claimed "35 security rules (32 locked)" but actual count is 37 (34 YAML + 3 dynamic), 34 locked
• mcp.md: Example used crust wrap --upstream but correct command is crust mcp http --upstream

Test plan

• doc consistency pre-commit hook passes
• go test ./internal/rules/ -run TestDocConsistency passes