Show how hidden complexity becomes real-world bugs: security pitfalls, vulnerability data and charts

…nd linter guardrails

- New pitfalls & verified examples (#60–#73):
  - Fundamentals (README.md): #60 all([]) vacuous truth, #61 itertools.groupby
    unsorted runs & shared cursor, #62 chained comparisons with in/is/==,
    #63 match/case bare-name capture.
  - Concurrency (docs/concurrency.md): #64 async for early-break cleanup leaks
    (contextlib.aclosing), #65 asyncio.gather() orphaned sibling tasks,
    #66 subprocess.Popen.wait() pipe buffer deadlocks, #67 GIL dict compound-op
    & free-threaded assumptions.
  - Object model (docs/object-model.md): #68 built-in dict/list C fast-path
    method bypasses, #69 __slots__ lost in subclasses, #70 __len__ falsiness.
  - Interpreter (docs/interpreter.md): #71 deferred/stringified annotations vs
    runtime introspection.
  - Data systems (docs/data-systems.md): #72 urllib.parse.urljoin path/origin
    pitfalls, #73 Unicode normalization & .casefold() vs .lower().
- Improvements to existing entries & repo tooling:
  - Add benign stdlib runnable examples for #58 and #59 (73/73 coverage).
  - Highlight isinstance(True, int) JSON validation trap in #14.
  - Add set/dict un-findable NaN key growth to #44.
  - Link #53 safe_join TOCTOU discussion to filelock advisories & clarify
    CWE-22 counts in docs/security.md.
  - Add copy-paste Ruff/type-checker/runtime guardrail section to README.md.
  - Add free-threaded CPython 3.13t and 3.14t to .github/workflows/verify.yml.

…ample

…rails

Add 14 leaky-abstraction pitfalls (#60–#73), 100% example coverage, and linter guardrails