docs: Shadow MCP terminology, kill switch example, Gemini CLI

[Siddhant-K-code]

Changes

Shadow MCP terminology

• Renamed "Shadow AI detection" → "Shadow MCP detection" — Salt Security named this as the enterprise category in their 1H 2026 State of AI and API Security report. Using their language makes the feature discoverable to enterprise buyers searching for this term.
• Updated CLI commands table description to match.

CSA stat added to audit-tools

• Added: "A CSA survey of 418 security professionals found 82% of enterprises discovered at least one AI agent their security team didn't know about in the past year." with source link.
• Makes the enterprise case concrete without a separate blog post.

Kill switch

• Added one sentence to the Why section: "Set rules to stop the agent automatically — cost ceiling, wrong file touched, too many tool calls. The agent stops. No prompt, no retry, no damage."
• Added a concrete .watch-rules.json example to the kill switch section (cost ceiling, file glob, files modified threshold).

Gemini CLI

• Added to the tagline: "Claude Code, Cursor, Gemini CLI, or any MCP client"
• Added to the audit-tools detected tools list
• Gemini CLI shipped in April 2026 with MCP support — agent-trace captures it automatically via the MCP proxy.