docs: audience-segmented README rewrite

[noisyloop]

Rewrites README.md into three deliberately separate, non-overlapping sections — (1) developer building a custom agent, (2) security engineer evaluating for deployment, (3) technical decision-maker — no general audience, no merged sections. Accurate technical claims and control descriptions are preserved; reorganized by reader.

Per-flag decisions applied:

• Header: "Production hardened" → "Production-grade architecture"; "NIST AI RMF 1.0 compliant" → "NIST AI RMF aligned"
• E-2 kept as ❌ CRITICAL, not softened; risk tiers described as an enforced policy control, not an isolation boundary
• Actuator guarantee rewritten honestly around E-2 (holds vs honest agents/accidental misuse, not vs a compromised in-process agent)
• Added the MODEL_GUARD_SIGN_KEY fallback caveat (STRIDE T-2)
• Removed the hardcoded test-count number
• docs/CONTROLS.md verified complete and cited as-is (its stale paths are a separate follow-up, not touched here)

STRIDE.md (flag decisions 2 and 8):

• S-2 marked resolved (commit 54628dd): the unauthenticated server.ts /api/approvals/:id/{approve,deny} endpoints were removed, route now 410 Gone, no approval:decision emission — table row, detailed section resolution note, and implementation-status note updated
• Scope updated to main; status date updated to 2026-05-19