docs: clarify category gate thresholds

[Yurii201811]

Summary

• Clarifies that --fail-on-category uses inclusive legacy category risk thresholds.
• Documents the permissions:0 pitfall: it fails even when the category score is 0.
• Adds a safer zero-risk example with permissions:1 and updates the changelog.

Fixes #217

Type of change

• Bug fix
• New feature / analyzer
• Breaking change
• Documentation

Test plan

• uv run pytest
• uv run ruff check src tests
• Manual CLI test (if applicable)

  uv run mcts scan examples/vulnerable-mcp-server/server.py
  uv run mcts scan examples/vulnerable-mcp-server/server.py -o report.json
  uv run mcts report report.json -o security-report.html

Additional local checks run:

• git diff --check
• python3 -m py_compile src/mcts/cli/main.py

Checklist

• CHANGELOG.md updated (if user-facing) — see Keep a Changelog
• Tests added or updated
• No secrets or credentials in code
• Docs updated if CLI behavior or report output changed — see Documentation index (guides live under docs/get-started/, docs/scanning/, docs/platform/, etc.)