Clarify fail-on-category threshold examples

[luohui1]

Summary

• Clarifies that legacy --fail-on-category gates use inclusive score >= limit semantics.
• Documents why permissions:0 fails even when the category score is 0.
• Recommends permissions:1 for zero-risk permissions gates that should allow a clean tile and fail on any positive risk.

Fixes #217

Type of change

• Bug fix
• New feature / analyzer
• Breaking change
• Documentation

Test plan

• uv run pytest tests\test_category_gates.py
• uv run ruff check src tests
• Manual CLI help check

  uv run mcts scan --help | Select-String -Pattern "fail-on-category|permissions:1|permissions:0" -Context 0,3

• uv run pytest

Full uv run pytest currently reports 589 passed and 3 failures on Windows that appear unrelated to this docs/help change:

• tests/test_api_limits.py::test_api_rate_limit
• tests/test_config_discovery.py::test_resolves_venv_python
• tests/test_skills_inventory.py::test_discover_skills_from_project_dir

Checklist

• CHANGELOG.md updated (if user-facing) — see Keep a Changelog
• Tests added or updated
• No secrets or credentials in code
• Docs updated if CLI behavior or report output changed — see Documentation index (guides live under docs/get-started/, docs/scanning/, docs/platform/, etc.)