v3.11.1 — README catch-up for v3.11.0 piston ship
Patch release. Docs-only. Three stale spots in README missed during
the v3.11.0 ship:
- Tools and capabilities bullet list now includes piston
(Sandboxed code execution — nsjail isolation, Python+Node
default, PISTON_LANGUAGES extensible, REST + MCP).
- Services table piston row: dead piston-pull sidecar reference
removed; default langs corrected to Python+Node; pre-bake-at-
build-time + aigate-internal-only network model documented;
Authorization-header-strip detail added.
- Security section: "All containers no-new-privileges" qualified
for the two genuine carve-outs (piston privileged for nsjail,
tailscale NET_ADMIN for tun) — matching the already-correct
Network-isolation section lower in the README.
No code, config, or behavior changes.