Summary

• Label installed CLI, Rust dependency, reviewer evidence, and maintainer proof paths separately in first-run and contract-pack docs.
• Lead downstream how-to docs with installed uselesskey ... commands, while keeping cargo run -p uselesskey-cli -- as a repo-checkout equivalent.
• Mark the installed CLI docs work item done and move clean-project examples to ready.

Files added/changed

• README.md
• docs/VERIFICATION.md
• docs/contract-packs/README.md
• docs/how-to/start-here.md
• docs/how-to/test-webhook-signature-validation.md
• docs/how-to/test-tls-chain-validation.md
• docs/how-to/test-oidc-jwks-validation.md
• docs/how-to/generate-scanner-safe-k8s-secret.md
• docs/how-to/export-vault-kv-fixtures.md
• .uselesskey/goals/active.toml

Validation

• cargo xtask docs-sync --check
• cargo xtask typos
• cargo xtask spec-check --strict
• git diff --check

Non-goals

• No v0.10.0 release prep, version bump, tag, or publish.
• No new contract packs, badges, provider compatibility claims, or production security claims.
• No CLI behavior changes or dependency churn.

What this enables next

• Clean-project adoption examples can now build from docs that clearly separate installed-user commands from repo-local proof machinery.