Qualify a passing marking rule where the reader sees it

[Tippel-AI]

Closes #19.

The problem

Article 50(2) asks for output to be marked and detectable as artificially
generated. The Commission Guidelines say satisfying one limb does not discharge
the other.

markproof measures the first, against the operator's own configuration. It cannot
measure the second — and this is not a gap to be closed in a later release:
whether a third party who does not hold those keys can detect the mark is a
property of the ecosystem, not of the endpoint under test. No probe run
against a system can establish it.

So MPF-T-001 PASS is a smaller statement than it looks. docs/DISCLAIMER.md
already said so, which is the wrong place — nobody reading a report opens the
disclaimer of the tool that produced it.

What a reader sees now

**All 1 applicable checks passed.**

| ✅ | `MPF-M-001` | images | 1 asset carries a valid, correctly marked manifest |

**Article 50(2) has two limbs.** The marking checks above measure whether the mark
arrived, against your own configuration. They do not measure whether a third party
can detect it — that is a property of the ecosystem, not of your endpoint, and no
probe run against your system can establish it. A passing marking check is not, on
its own, Article 50(2) compliance.

The qualification lands directly under "all checks passed", which is the sentence
it exists to qualify. Same wording in the PDF — the artefact actually handed to an
auditor, and therefore where the over-reading happens. A test asserts the two
cannot drift apart, since a reader comparing them should find no difference to
interpret.

Scoped deliberately

Only on a pass, and only for the two marking obligations. Nobody over-reads a
failure, and a note printed unconditionally is one more line people learn to skip —
the same defect as MPF-L-001 warning about every media target (#27).

Obligation.is_marking carries the reasoning, so the renderers ask a question with
a documented answer rather than pattern-matching on strings.

Why now rather than later

The gap is live. Text-watermark detection tooling is largely announced rather than
shipped, and where it exists it is key-gated — which the Guidelines treat as the
weaker of the two footings. An operator reading a green run as full Article 50(2)
compliance today would be wrong in a way that only surfaces when someone asks.

450 tests, ruff + mypy strict clean.

🤖 Generated with Claude Code