Summary

• Rework the README first screen around installed CLI, Rust facade, CI audit, reviewer packet, and repo-proof user paths.
• Add the generate -> verify -> inspect -> audit webhook loop and audit-bundle --ci as a first-screen CI path.
• Keep boundaries explicit: no production security/provider compatibility claims, no permission to commit generated secret-shaped payloads, and repo public claims remain repo-local proof.
• Mark readme-front-door done and move cli-help-self-check-audit to ready in the active goal.

Boundaries

• No release prep, version bump, tag, or publish.
• No new contract pack, badge, dependency churn, provider compatibility claim, production security claim, or installed CLI proof execution.

Validation

• cargo +nightly xtask spec-check --strict
• cargo +nightly xtask docs-sync --check
• cargo +nightly xtask typos
• cargo +nightly xtask external-adoption-smoke --path .
• cargo +nightly xtask pr-lite
• git diff --check