docs: fix weaver-spec compatibility table and CI job name

- README I-01: correct claim that raw output is 'never returned';
  raw mode exists but is restricted to admin principals only
- README I-06: fix revoke_token() → revoke(token_id) and
  revoke_all() → revoke_all(principal_id) to match actual API
- ci.yml: rename job conformance → conformance_stub and display
  name to make stub status unambiguous in PR check summaries
- ci.yml: add comment clarifying weaver-contracts (pip) vs
  weaver_contracts (Python module) naming difference

Addresses copilot-pull-request-reviewer comments on PR #65.

Author: dgenio

.github/workflows/ci.yml

@@ -46,8 +46,8 @@ jobs:
           python examples/billing_demo.py
           python examples/http_driver_demo.py
 
-  conformance:
-    name: "Weaver Spec Conformance (v0.1.0)"
+  conformance_stub:
+    name: "Weaver Spec Conformance Stub (v0.1.0)"
     runs-on: ubuntu-latest
     needs: test
     permissions:
@@ -67,6 +67,7 @@ jobs:
       # Placeholder: activate once dgenio/weaver-spec#4 ships the conformance suite.
       # Replace this step with:
       #   pip install weaver-contracts
+      #   # Distribution name uses a hyphen; the Python module uses an underscore.
       #   python -m weaver_contracts.conformance --target agent_kernel
       - name: weaver-spec conformance suite (stub)
         run: |

README.md

@@ -117,9 +117,9 @@ The following invariants are satisfied:
 
 | Invariant | Description | How agent-kernel satisfies it |
 |-----------|-------------|-------------------------------|
-| **I-01** | LLM never sees raw tool output by default | `Context Firewall` always transforms `RawResult → Frame`; raw driver output is never returned to the caller |
+| **I-01** | LLM never sees raw tool output by default | `Context Firewall` always transforms `RawResult → Frame`; raw driver output is not returned by default, and non-admin principals cannot obtain `raw` response mode |
 | **I-02** | Every execution is authorized and auditable | `PolicyEngine` evaluates every invocation; `TraceStore` records every `ActionTrace`; `HMACTokenProvider` validates tokens before execution |
-| **I-06** | CapabilityTokens are scoped | Tokens bind `principal_id + capability_id + constraints` with an explicit TTL; `revoke_token()` / `revoke_all()` are supported |
+| **I-06** | CapabilityTokens are scoped | Tokens bind `principal_id + capability_id + constraints` with an explicit TTL; `revoke(token_id)` / `revoke_all(principal_id)` are supported |
 
 See [docs/agent-context/invariants.md](docs/agent-context/invariants.md) for the full internal invariant list and [weaver-spec INVARIANTS.md](https://github.com/dgenio/weaver-spec/blob/main/docs/INVARIANTS.md) for the specification.