docs(billing): disprove current cc_version suffix algorithm; defer fix

Validated the existing SHA-256(salt + text[4,7,20] + version) algorithm in
src/headers/billing.ts against 5 real CC 2.1.113 OG captures from
.sisyphus/evidence/phase-1-claim-validation/2026-04-17/proxyman-*/. Result:
0/5 match.

Empirical disproof:

All 5 captures have identical first-user-message text (302 chars, an
OpenCode session-start hook). The current algorithm produces identical
output for identical text, so it would emit ONE suffix for all 5
captures. Instead, CC emitted 5 distinct suffixes:

  proxyman-minimal-hi-2.1.113       suffix=9c8
  proxyman-mcp-tool-call             suffix=23a
  proxyman-long-context              suffix=be8
  proxyman-adaptive-thinking-shared  suffix=e97
  proxyman-opus-effort-xhigh         suffix=9e4

The text alone cannot be the full input. Additional hypotheses tested
and ruled out:

- sha256(salt + x-claude-code-session-id + version)[:3] — 0/5
- sha256(salt + x-client-request-id + version)[:3]     — 0/5
- sha256(session_id)[:3]                                 — 0/5
- sha256(request_id)[:3]                                 — 0/5
- literal substring of session_id (any position)         — 0/5
- literal substring of request_id (any position)         — 0/5
- sha256(bodyText)[:3]                                   — 0/5
- sha256(messagesJson)[:3]                               — 0/5
- substring of the cch field                             — 0/5

Impact assessment: LOW.

Anthropic accepts the request regardless of suffix match; the field is
a billing/tracing hint, not an authentication check. Captured plugin
requests in Phase 1 (with the CURRENT algorithm) were all accepted by
the API with 200 OK. No user-visible regression.

Changes:

- tests/unit/headers/billing-suffix.test.ts (new):
  - 5 golden-pair tests under `describe.skip(...)` with inline comment
    pointing at the investigation result. Un-skip once the algorithm
    is correct.
  - 2 live tests covering the current algorithm's shape + determinism
    (passing today) to prevent silent code-level regression of the
    existing behavior.
- docs/mimese-http-header-system-prompt.md:
  - Replace the "SHA-256 with salt and positions [4,7,20]" confident
    paragraph with an accurate summary of the investigation, the
    ruled-out hypotheses, the impact classification, and a pointer to
    the golden-pair tests.

Phase A.2 budget spent (~40 min of investigation); converging on the
real algorithm is deferred to a Phase 3 follow-up per plan decision
matrix. v0.2.0 ships with the current algorithm unchanged.

Verification:

- 77 test files / 1345 tests pass + 5 skipped (up from 76/1343 pre-A.2).
- lint clean, typecheck clean.
- No src/ code change in this commit; docs + tests only.