Fuzz verify and the address overview; fix three doc inaccuracies

[devdavidejesus]

Findings of an independent audit of the docs against the code.

• Fuzzer: the README says the Atheris fuzzer exercises every parser of untrusted data, but verify_tx and get_address_overview were not in the arbitrary-JSON target. Both are now. Half of the verify runs get API answers that agree with each other (the header commits to the Merkle root, the status names the header's hash), so every check up to proof of work is reached, not only the first ones. Locally: about 0.9M runs of the final harness with no crash; replaying the corpus shows verify reaching the proof-of-work checks.
• README: exit code 1 for an unconfirmed transaction applies to verify only (tx shows it as unconfirmed and exits 0).
• SECURITY.md: "no lockfile" is true of the package; the repository's lockfiles pin CI tools only.
• tests.yml: the comment now lists every check that branch protection requires by name (it named only test (3.x)).

No change to the package code.