Fix CONTRIBUTING.md clone path and SECURITY.md validation claim

CONTRIBUTING.md: cd pygate → cd quick-gate-python (matches clone dir)
SECURITY.md: correct false claim that max-attempts is validated as
positive integer — it passes through to argparse without positivity check

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: roli-lpci

CONTRIBUTING.md

@@ -15,7 +15,7 @@ Thank you for your interest in contributing to PyGate! This guide will help you
 
 ```bash
 git clone https://github.com/roli-lpci/quick-gate-python.git
-cd pygate
+cd quick-gate-python
 python -m venv .venv
 source .venv/bin/activate
 pip install -e ".[dev]"

SECURITY.md

@@ -42,7 +42,7 @@ PyGate executes external tools (`ruff`, `pyright`, `pytest`) via subprocess. Sec
 
 ### GitHub Actions Composite Action
 
-- **Input validation**: The composite action validates the `mode` input against an allowlist (`canary` or `full`) before passing it to the CLI. The `max-attempts` input is validated as a positive integer. All inputs are passed via environment variables rather than string interpolation to prevent injection.
+- **Input validation**: The composite action validates the `mode` input against an allowlist (`canary` or `full`) before passing it to the CLI. The `max-attempts` input is passed through to the CLI's argparse, which validates it as an integer; negative values are not rejected at the action layer. All inputs are passed via environment variables rather than string interpolation to prevent injection.
 - **Supply chain pinning**: All third-party actions in CI workflows and the composite action are pinned to SHA digests with version comments (e.g., `actions/checkout@<sha> # v4`). This prevents compromised upstream tags from injecting malicious code.
 - **Permissions**: The composite action requires only `contents: read` by default. The optional PR comment feature requires `pull-requests: write`. No other permissions are requested.
 - **Artifact trust**: Artifacts uploaded to `.pygate/` contain command output (stdout/stderr) from the target project. Downstream consumers should treat these as untrusted data and validate before rendering in security-sensitive contexts.