docs: add LIMITATIONS.md, and fix the SPONSORS page 404 while registering it

[imran-siddique]

LIMITATIONS.md

Every other public AgenTrust project ships one and this one did not. It matters more here than elsewhere, because this suite issues pass and fail verdicts about other people's records, so what it does not check is part of reading the verdict.

Written against the code rather than from memory. The three that matter:

Check	What it actually establishes
TR-RTE	Validates the shape of the attestation fields. It does not obtain a quote or verify one against an AMD, Intel or TPM root, so Level 1 can be reached with a well formed measurement no hardware produced.
TR-ANC-002	Replays the audit path against the Merkle root carried in the receipt you supply. It does not fetch the transparency URI and does not establish that the root is one a public log published. It rules out a record modified since anchoring, not a self-made tree.
UNVERIFIED	Reachability, not correctness. Whether it fails a run is per code from the table in modules/unverified.py, not one blanket rule: TR-POL-003 is tolerated to Level 2, anything unnamed fails from Level 1.

Also covers perishable results (TR-ENV validates iat), the profile sentinel being a version-mismatch suspect before a defect, and that nothing here is independently assessed.

A live 404, fixed in passing

SPONSORS.md is in the mkdocs nav and exists in the repo, but was never in the allowlist that assembles .docs_build. So tests.agentrust-io.com/SPONSORS/ has been returning 404 from a nav link:

/SPONSORS/   404
/CHANGELOG/  200
/            200

Both files are now in the allowlist and in the deploy paths: filter, since a file that is in the build but not the filter merges green and never deploys.

Verification

Replicated the CI assemble-and-build steps locally rather than trusting the diff. Both LIMITATIONS and SPONSORS pages are produced.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uc16CsknaQ9PTLxGj8TXXj