README: update 'Do these settings reach the agent VMs?' with what was confirmed #68

Why

The README section "Do these settings reach the agent VMs?" (README.md:111-117) says the answer is "Unconfirmed", quotes an empty remote-settings.json seen on 2026-10-20, and tells readers to assume the managed settings do not reach the VMs. The tracking issue for that question has since recorded a result (2026-10-26): a managed deny rule blocks a command on a VM, and all four VMs resolve the org's settings. The README now tells agents and people the opposite of what was observed, so they plan around a gap that was shown not to exist. README.md:85 also points readers at an issue number as the way to verify delivery, and the section itself cites a private issue number, which a public README should not do.

Acceptance criteria

• The section states what was confirmed, with the date, and no longer says "Unconfirmed" or tells readers to assume the settings do not reach the VMs
• What is still not confirmed (if the tracking issue records anything open, such as the telemetry keys at managed scope) is listed separately, marked as open, with where it was checked
• The "fix if the cache is empty" paragraph is kept only as a fallback if the tracking issue is still open, and says so
• The section and the sentence at README.md:85 name no private repository, client or private issue number (this repo is public); they refer to "the tracking issue" instead
• bin/generate --check prints "generated files are current" and bash tests/run.sh passes on the branch (quote both results in the PR); no generated file changes

Files likely touched

• README.md

Risk class

R0: documentation only; no hook, rule, managed setting or policy file changes, and no generated file changes.

Part of the T3 test backlog.