docs: add verified researcher quickstart - #96

Summary

Make the repository front door researcher-first with a closed, machine-checked CAGE-2 conformance quickstart that runs from the installed distribution and states exactly what its evidence does and does not establish.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #23

ADR Impact

• ADR-021

Changes

• Rewrite the README around the verified installed-distribution quickstart, bounded expected output, artifact locations, claim levels, supported evidence, limitations, and researcher controls.
• Add researcher and maintainer documentation paths while keeping contributor, build, release, governance, and repository mechanics outside the main reader flow.
• Add a closed quickstart contract checker and exercise it against built and published distributions without shell execution or path escape.
• Strengthen project-service governance tests with negative fixtures and behavior-level Nox log-suppression coverage.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

15 focused tool tests pass. The post-fix completion and policy gates passed, and the publish boundary reran the canonical verification graph plus policy checks on the synchronized tree.

Ground Control Checks

• Configured repository policy command passes
• Pre-push code review and test-quality review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: (none — bug/refactor/maintenance run)
• TESTS: (none — documentation/configuration/structural-invariant run)

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.