docs: README 的授权段说 vendored 源码「unchanged」,而那句话现在是假的

⚠️ llvm/PATCHES.md 记录着五处原地标记补丁,而 README 的授权段写着 vendored 源码
「are unchanged」。一句与授权相邻的陈述不该与台账矛盾。

改为「几乎未改动」,并把例外**枚举**出来而不是描述:四个文件五处区域,各自夹在
BEGIN/END 之间,一条 grep 数得完。同时写明判据(upstream 在这里问哪个 OS,而真正
的答案是 openkal 的某个接口)以及那份文档更重要的另一半 —— 十九处 <windows.h> 里
有十二处**不需要动**,谓词答对之后 libc++ 的 POSIX 分支本来就已经经 musl 到达
openkal。

并补一节「四个目标,一份源码」:四种目标格式、各自怎么被运行,以及为什么裸机那个
不会侥幸通过;⚠️ 并写明产物是在**真机上被运行**而不是被检查 —— 这个包在 Mach-O 和
PE 上要找的每一处差异都是链接成功、运行时失败。

Author: speak-agent

README.md

@@ -122,6 +122,32 @@ that enquiry from `__ehdr_start`.
 
 A package that had only ever been built would have shipped that.
 
+## Four targets, one source
+
+`examples/same-source` is built for four machines from one `src/main.cpp` with
+nothing edited between them, and it prints the same four lines on each:
+
+| target | format | how it is run |
+|---|---|---|
+| `x86_64-linux-gnu` | ELF | directly |
+| `x86_64-windows-gnu` | PE32+ | on a Windows machine |
+| `aarch64-macos` | Mach-O | on an arm64 Mac |
+| `riscv64-none-elf` | ELF | QEMU with real OpenSBI firmware |
+
+The fourth is the one that cannot pass by accident. A hosted target has a C
+library, a C++ runtime and an unwinder already installed, so a program that
+reaches one of them by mistake still works. There is nothing to reach on the
+fourth: the C library is openkal-musl, the standard library and the unwinder are
+this package's, and beneath them is firmware whose whole interface is `ecall`.
+
+⚠️ **And the artefacts are run on the real machines, not inspected.** Continuous
+integration builds all three hosted targets on Linux and executes each on the
+system it was built for; `mcpp`'s own `openkal-cross` workflow builds them from
+three hosts and runs all nine combinations. Every difference this package had to
+find on Mach-O and PE — the loader-bootstrapped thread-local, the unwinder's
+search for its own tables, the personality routine, the visibility of weak
+definitions — **links successfully and fails at run time**.
+
 ## Not supported
 
 - **the sanitizers.** compiler-rt's sanitizers depend on a host's internals —
@@ -131,4 +157,19 @@ A package that had only ever been built would have shipped that.
 ## Licence
 
 The port is Apache-2.0. The vendored sources under `llvm/` are Apache-2.0 with
-LLVM exceptions and are unchanged; `llvm/LICENSE.TXT` is theirs.
+LLVM exceptions; `llvm/LICENSE.TXT` is theirs.
+
+⚠️ They are **almost** unchanged, and the exceptions are enumerated rather than
+described. `llvm/PATCHES.md` lists every one — five regions in four files, each
+between `// ─── openkal ─── BEGIN` and `// ─── openkal ─── END`, countable with
+
+```sh
+grep -rn "openkal ─── BEGIN" llvm/
+```
+
+Each replacement fits one sentence: *upstream asks here which operating system
+this is, and the real answer is openkal's `<interface>`.* A change that does not
+fit it is not made. The larger half of that document is the list of places that
+did **not** need changing — twelve of the nineteen `#include <windows.h>` sites
+resolve themselves once the predicate is answered correctly, because libc++'s
+POSIX branch was already reaching openkal through musl.