fix(07-06): root-cause the /cari menu defect — register-commands.mjs sent the wrong Bot API field name

- the Bot API parameter is 'scope' (verified against
  core.telegram.org/bots/api/methods/setmycommands); the script's
  'bot_command_scope' was an unknown field Telegram silently ignores,
  so every call hit the default scope and the two clear calls wiped the
  default set entirely — the ok:true lines proved nothing about scope
- registration re-run: default (agnostic/en/ms) + all_private_chats
  (agnostic/ms) read back help, privacy, cari via getMyCommands with
  the correct 'scope' param; group scopes verified cleared
- docs/KNOWN-LIMITATIONS.md: the 'Telegram-side defect' attribution
  corrected to the actual script bug; residual client menu-caching
  caveat + type-the-command workaround kept
- bot/README.md command row updated to the real scope set

docs/KNOWN-LIMITATIONS.md

@@ -42,15 +42,18 @@ breaks the project's $0 mandate.
 
 ## The /cari command may be missing from the Telegram menu
 
-Some drivers see a command menu listing `/help` and `/privacy` but **not** `/cari`.
-This is a Telegram `setMyCommands` scope-resolution behaviour, not a bot bug:
-Telegram resolves a chat's menu from the narrowest scope that has ANY commands set,
-so a stale non-default scope (for example an old `all_private_chats` set recorded
-before `/cari` existed) shadows the default scope's fuller menu. The bot re-arms
-every such scope (`bot/scripts/register-commands.mjs`), but the Telegram client may
-keep showing the cached menu until the app restarts. **The workaround: type `/cari`
-in the chat** — the command itself has always worked; only its discoverability is
-affected.
+Some drivers saw a command menu listing `/help` and `/privacy` but **not** `/cari`.
+ROOT CAUSE (found and FIXED 2026-10-25, 07-06 launch-gate canary): it was a bot-side
+script bug, not a Telegram defect — `bot/scripts/register-commands.mjs` sent the scope
+under the wrong parameter name (`bot_command_scope`; the Bot API field is `scope`),
+which Telegram silently ignores, so every registration call actually hit the default
+scope and the group-scope "clear" calls wiped the default set entirely. The correct
+parameter was verified against https://core.telegram.org/bots/api/methods/setmycommands,
+the script was fixed, and all private-chat scopes now read back `help, privacy, cari`
+via `getMyCommands` (verified 2026-10-25). What REMAINS: the Telegram client caches the
+menu — a device that opened the bot before the fix may keep showing the stale menu
+until the app restarts. **The workaround: type `/cari` in the chat** — the command
+itself has always worked; only its discoverability was affected.
 
 ## Beta quality