Stitch the Remediate pillar together with a step-by-step operator
guide that walks through yank --mark-compromised → fix-forward plan →
publish → optional plan-yank finalize. Tied to docs/README.md's how-to
index so operators can find it without folklore.

Covers:
- 4-step remediation flow with concrete commands
- Worked example: single-CVE in a multi-crate workspace
- Explicit statement of what yank does NOT do (lockfile invalidation,
  version bumping, consumer notification)

No code changes. This only references commands added in this branch
stack (#121 yank, #129 plan-yank, #131 mark-compromised + fix-forward).

Stitch the Remediate pillar together with a step-by-step operator
guide that walks through yank --mark-compromised → fix-forward plan →
publish → optional plan-yank finalize. Tied to docs/README.md's how-to
index so operators can find it without folklore.

Covers:
- 4-step remediation flow with concrete commands
- Worked example: single-CVE in a multi-crate workspace
- Explicit statement of what yank does NOT do (lockfile invalidation,
  version bumping, consumer notification)

No code changes. This only references commands added in this branch
stack (#121 yank, #129 plan-yank, #131 mark-compromised + fix-forward).

Stitch the Remediate pillar together with a step-by-step operator
guide that walks through yank --mark-compromised → fix-forward plan →
publish → optional plan-yank finalize. Tied to docs/README.md's how-to
index so operators can find it without folklore.

Covers:
- 4-step remediation flow with concrete commands
- Worked example: single-CVE in a multi-crate workspace
- Explicit statement of what yank does NOT do (lockfile invalidation,
  version bumping, consumer notification)

No code changes. This only references commands added in this branch
stack (#121 yank, #129 plan-yank, #131 mark-compromised + fix-forward).

…134)

* feat(remediate): --mark-compromised + shipper fix-forward (#98 PR 3)

Close the remediation staged rollout: yank (PR 1) + plan-yank (PR 2) +
**fix-forward planning (this PR)** give operators the three building
blocks for handling a compromised release without improvising.

## What's new

### \`shipper yank --mark-compromised\`

New opt-in flag on the existing yank primitive. When set, after a
successful \`cargo yank\`, shipper also amends the matching
\`PackageReceipt\` in \`<state_dir>/receipt.json\` with:

- \`compromised_at = Utc::now()\`
- \`compromised_by = <--reason>\`

These are the fields added (additively) in PR 2 (#129). The amendment
lets downstream commands find compromised packages without scanning
events.jsonl.

Behaviour is tolerant:
- No receipt → warn + proceed (yank still succeeds)
- No matching package in receipt → warn + proceed
- Load/write errors → warn + proceed (yank already happened; a
  receipt-write failure doesn't retroactively unyank)

### \`shipper fix-forward --from-receipt <path>\`

New planning command. Reads a receipt, finds packages flagged
\`compromised_at = Some(_)\`, and prints an ordered supersession plan:

- Topological order (dependencies first, dependents last) — opposite
  of plan-yank, because fix-forward *publishes* replacements while
  plan-yank *removes* reachability.
- Suggested successor versions use a placeholder format (\`<old>-next\`)
  so the operator picks the real bump (patch / minor / major).
- Instructional preamble walks through the full remediation loop:
  bump Cargo.toml → commit → \`shipper publish\` → optional
  \`shipper plan-yank --compromised-only\` for containment.

Like plan-yank, fix-forward is **planning only**. It does not edit
Cargo.toml or invoke publish — those are operator steps.

## Tests

4 new tests in \`engine::fix_forward::tests\`:

- only compromised+Published packages produce steps (Failed-but-
  compromised packages are silently dropped — they were never shipped)
- topological order preserved from receipt.packages
- empty plan (no compromised packages) renders with guidance toward
  \`--mark-compromised\`
- text render enumerates steps with reason and points toward the
  publish + plan-yank follow-ups

Plus CLI snapshots for \`yank --help\` (gains \`--mark-compromised\`) and
\`fix-forward --help\`.

## Scope — explicitly NOT in this PR

- **Automated Cargo.toml bump.** Workspace-edit territory; needs its
  own PR with --dry-run, --apply, and git-cleanliness guards.
- **Publishing successors.** \`shipper publish\` already does this; fix-
  forward just tells the operator when to run it.
- **Chaining \`superseded_by\` back to the original receipt.** Requires
  post-publish receipt amendment from the successor run. Follow-on.
- **\`release_compromised\` top-level state.** The receipt-level marker.
  For now the per-package \`compromised_at\` fields cover the
  planning-level need.

* docs: how-to for remediating a compromised release (#98)

Stitch the Remediate pillar together with a step-by-step operator
guide that walks through yank --mark-compromised → fix-forward plan →
publish → optional plan-yank finalize. Tied to docs/README.md's how-to
index so operators can find it without folklore.

Covers:
- 4-step remediation flow with concrete commands
- Worked example: single-CVE in a multi-crate workspace
- Explicit statement of what yank does NOT do (lockfile invalidation,
  version bumping, consumer notification)

No code changes. This only references commands added in this branch
stack (#121 yank, #129 plan-yank, #131 mark-compromised + fix-forward).