Comment/README cleanup (todo §4); tighten the kratos/keto client module-headers (drop forward-refs + caller-listings, keep rationale), retarget the stale safeUrl() ref in plugin-contract.md to §5/§7

docs/plugin-contract.md

@@ -158,7 +158,8 @@ safety of the data it renders**:
   item, a breadcrumb, `brand.logo` — is emitted as-is inside the attribute: a `javascript:` or
   `data:` URL from upstream/user data becomes live XSS. When a URL comes from data you don't
   control, restrict it to a relative (`/`, `?`, `#`) or `http(s):` URL before handing it to a
-  partial. (A shared `safeUrl()` helper lands with the data-driven plugins in §4.)
+  partial. (A shared `safeUrl()` helper will land with the first plugin that renders untrusted
+  URL data, §5/§7.)
 
 ## RequestContext