docs(readme): adopt candid local-first product voice

[tcballard]

Summary

Implements the README and launch-evidence follow-up to Issue #29.

Adds:

• a full README rewrite in a direct, candid builder-operator voice
• a scannable explanation of the filing flow, safety contract, providers, Finder intake, evaluation evidence, and distribution state
• a reconciled Launch Pack for selected local-only build 0.1.0 (2)
• current public-link, asset, review-metadata, and submission-gate evidence
• a deterministic Store-policy preflight that cannot false-fail on a strings | grep -q broken pipe

Scope

Included

• README product narrative and technical guidance
• Launch Pack brief, claims, channel, asset, checklist, and handoff records
• App Review and submission handoff notes
• current Mac App Store state in docs/distribution.md
• the App Store binary-policy assertion in script/preflight_app_store.sh

Excluded

• application code or runtime behavior
• App Store metadata mutations, pricing choices, privacy attestation, or submission
• Developer ID/Homebrew release work
• installed Store-build smoke testing

Product / Architecture Decisions

• Kept “A drop folder with opinions.” as the established product line.
• Used “The model proposes; Swift decides” to state the actual authority boundary without marketing gloss.
• Described the app as local-first while preserving the stricter Store-only claim: Apple on-device processing or same-Mac Ollama, with no remote model route.
• Removed the warning-first presentation but retained the GitHub artifact’s ad-hoc-signing limitation in Distribution Status.
• Added claim C07 so “local-only providers” remains distinct from the Store’s “Data Not Collected” privacy claim.
• Kept the Launch Pack blocked from final readiness until the installed Store build is smoke-tested.
• Captured binary strings once before policy checks so pipefail cannot reinterpret an early successful grep -q exit as a missing marker.

User-Facing Contract

CLI

All existing commands and exit-code descriptions remain intact, including:

./script/build_and_run.sh
swift build -c release
.build/release/sorting-hat once --dry-run

Human Output

The README now explains the user journey first, keeps limits next to the features they qualify, and labels Store and GitHub distribution states separately.

JSON Output

No changes.

Exit Codes

No runtime changes. The README retains evaluator exit statuses 1 and 2.

Verification

Ran

python3 /Users/tballard/.codex/plugins/cache/tcballard-toolkit/tcballard-toolkit/0.0.13/skills/launch-pack/scripts/check_launch_pack.py launch-pack
python3 /Users/tballard/.codex/plugins/cache/tcballard-toolkit/tcballard-toolkit/0.0.13/skills/launch-pack/scripts/check_launch_pack.py launch-pack --final
python3 /Users/tballard/.codex/plugins/cache/tcballard-toolkit/tcballard-toolkit/0.0.13/skills/readme-front-door/scripts/audit_front_door.py README.md
./script/preflight_app_store.sh
bash -n script/preflight_app_store.sh
git diff --check

Covered

• structural Launch Pack validation: passed, 6/6 required files, version 0.1.0
• final Launch Pack validation: intentionally blocked only by the installed-build Store smoke test
• README title, placeholders, and local front-door paths: passed
• all remaining README local paths and executable script references: present
• Ollama, Issue release(macos): ship a Developer ID signed and notarized build #24, Issue release(app-store): ship a sandboxed Mac App Store build #29, support, and privacy links: HTTP 200
• screenshot and icon SHA-256 values match their provenance records
• Merge & Tell quality rubric: 13/14, with technical depth intentionally retaining a concision score of 1/2
• the exact sandboxed App Store archive preflight that failed in CI now passes locally

Review Path

Review the README narrative first, then the claim/channel matrix, launch brief and handoff, release checklist, and distribution status update.

Notes For Reviewer

The Store build is selected but not submitted or published. Pricing, App Privacy, export compliance, content rights, and installed-build verification remain owner-controlled gates.