docs: lead the README with the receipts

[askalf]

Why

The strongest facts truecopy has — 68,560 skills scanned across two published studies, zero poisoned, a weekly public watch, a Marketplace action — were buried mid-README or missing from it entirely (the Action wasn't mentioned once). Anyone landing from npm, the Marketplace, or the blog funnel should hit the receipts in the first screenful.

What

• Badges: npm version + GitHub Marketplace added ahead of the watch + Scorecard badges
• Hero block after the tagline: 2,019 official-directory skills + 66,541 ClawHub skills scanned (both study links), the Monday standing watch, and the self-applied CI gate
• In CI now leads with \�skalf/truecopy-action@v1\ (verify + scan-mode) and links this repo's own gate workflow; the npx snippets stay
• Hook-install example updated from the stale #v0.6.2\ pin to #v0.8.0\

Merge after #63 — the hero and CI sections link \ ruecopy.lock\ and .github/workflows/truecopy-gate.yml, which #63 introduces.

No version bump — docs only, fires no release.

🤖 Generated with Claude Code

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer (sprayberry-reviewer bot).

Verdict: clean docs-only PR — approved.

---

What I checked

Scope: README.md only, +16/−2 lines. No code, no logic, no tests. Four distinct hunks reviewed:

1. Badge line (README.md:3) — two badges prepended (npm version + GitHub Marketplace). Badge URL construction is correct: %40askalf%2Ftruecopy is valid percent-encoding for @askalf/truecopy. Both point to real destinations.

2. Hero block (after tagline) — references 2,019 and 66,541 skill counts with links to the two published study posts. Links truecopy.lock and truecopy-gate.yml as relative paths — both files now exist on master (#63 merged at 2026-07-16T18:32Z, before this review). No broken links.

3. Hook pin bump (README.md:100) — #v0.6.2 → #v0.8.0. Confirmed v0.8.0 is the current latest tag on askalf/truecopy. Correct.

4. In CI block (README.md:161+) — leads with askalf/truecopy-action@v1. Confirmed v1 tag exists on askalf/truecopy-action. The YAML snippet shows two entries under a shared - uses: line labelled with # …or scan-mode: — this is a standard documentation pattern for alternatives, not a runnable step sequence, and the comment makes the intent clear. truecopy-gate.yml reference links to the now-merged workflow.

---

What's good

The bump from the stale #v0.6.2 pin to #v0.8.0 is an important correctness improvement for anyone copy-pasting the hook example. The hero block surfaces real, verifiable proof-of-work in the first screenful rather than burying it — a genuine usability win for new visitors from npm or the Marketplace.

---

No blocking findings.

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: no blocking issues found — approving.

---

What I checked

This is a documentation-only PR (+16/−2, all in README.md). There is no logic, no tests, and no security surface to change. My review focused on:

1. Factual accuracy of the new claims — the 68,560 aggregate (2,019 + 66,541 = 68,560 ✓), both blog-post links are present and plausible.
2. Linked artefacts exist — truecopy.lock and .github/workflows/truecopy-gate.yml (both introduced by the now-merged #63) are present on master. The #63 dependency is satisfied.
3. Version pin updated correctly — the hook-install example moves from #v0.6.2 to #v0.8.0; tag refs/tags/v0.8.0 exists in the repo. ✓
4. Badge URLs — npm and Marketplace badge shields use standard img.shields.io endpoints with correct scoping (@askalf/truecopy, truecopy-gate-your-agent-skills). No broken badge.
5. CI — all 9 status checks pass on the head commit (CI matrix ×6, CodeQL ×2, truecopy gate). ✓

Minor (non-blocking)

The "In CI" YAML block presents two uses: steps sequentially, while the lead-in prose says "verify … or poison-scan". The # …or scan-mode comment on the second step does signal alternation, but a reader copy-pasting the whole block gets both steps. No harm done (running verify + scan is redundant, not wrong), and the intent is clear in context — just worth a future clarification separating them into two labelled snippets.

What's good

The hero block is tight and evidence-backed. Updating the stale v0.6.2 pin while you're in the file is exactly the right kind of opportunistic hygiene.