docs(readme): state verifier-only (issuance stays in the Python core / cloud) (#2)

Make explicit that the Java port verifies credentials and delegation chains but
does not issue them — issuance stays in the Attestix Python core or cloud — so
nobody expects to mint credentials from Java. Parent link, spec/bundle/v1 link,
and the spec/verify/v1 conformance note are already present.

Author: ascender1729

README.md

@@ -11,6 +11,10 @@ canonical form **byte-for-byte** and is validated against the shared
 cross-language conformance vectors (`spec/verify/v1/vectors.json` in the parent
 repo, vendored here under `testdata/` and `src/test/resources/`).
 
+This port is **verifier-only**: it verifies credentials and delegation chains;
+it does not issue them. Issuance stays in the Attestix Python core
+(`pip install attestix`) or Attestix Cloud.
+
 - Parent project: <https://github.com/VibeTensor/attestix>
 - Bundle wire-format spec: <https://attestix.io/spec/bundle/v1>
 - Ed25519 via [BouncyCastle](https://www.bouncycastle.org/) (trusted, deterministic)