docs: clarify artifact origin wording in README #259

	name: Drift Guard

	on:
	pull_request:
	push:

	jobs:
	guard-demo-artifacts:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Guard expected demo artifacts
	shell: bash
	run: \|
	set -euo pipefail

	DEMO_FILE="examples/snapshot_v1_demo/expected_verify_report.json"
	BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME:-$(git rev-parse --abbrev-ref HEAD)}}"

	git fetch origin main --depth=1

	CHANGED_FILES="$(git diff --name-only origin/main...HEAD \|\| true)"

	DEMO_CHANGED=false
	if printf '%s\n' "$CHANGED_FILES" \| grep -Fxq "$DEMO_FILE"; then
	DEMO_CHANGED=true
	fi

	IS_DEMO_BRANCH=false
	case "$BRANCH" in
	chore/update-demo-golden-\|demo-artifact/)
	IS_DEMO_BRANCH=true
	;;
	esac

	if [ "$DEMO_CHANGED" = true ]; then
	if [ "$IS_DEMO_BRANCH" = true ]; then
	EXTRA_FILES="$(printf '%s\n' "$CHANGED_FILES" \| grep -Fxv "$DEMO_FILE" \|\| true)"
	if [ -n "$EXTRA_FILES" ]; then
	echo "ERROR: dedicated demo-artifact branches may only modify:"
	echo " $DEMO_FILE"
	echo
	echo "Additional changed files detected:"
	printf '%s\n' "$EXTRA_FILES"
	exit 1
	fi

	echo "INFO: intentional demo artifact update allowed on dedicated branch: $BRANCH"
	exit 0
	fi

	echo "ERROR: expected demo artifacts changed. This usually indicates drift."
	echo "If this is intentional, do it in a dedicated PR with explicit justification."
	echo
	echo "Allowed branch patterns:"
	echo " chore/update-demo-golden-*"
	echo " demo-artifact/*"
	exit 1
	fi

	echo "INFO: no demo artifact drift detected"

Provide feedback