[bmscomp]

Why

Addresses four GitHub storefront and operational trust leaks:

1. Website visibility (katesplatform.io): The repository homepage URL was blank (now set to https://katesplatform.io), and README.md only linked to the book rather than surfacing the main site alongside it.
2. Opening README.md pitch: Bullet 2 under What it does foregrounded unbundled Litmus experiment timeouts before explaining provider coverage.
3. make cli-install on Linux: Makefile ran macOS-only xattr and codesign unconditionally, failing on Linux before running the PATH shadowing check and requiring a workaround note in README.md.
4. Scheduled Security failures (Scheduled run failed: Security #264):
   • Resolve the pinned image used a single getline after repository: ghcr.io/bmscomp/kates, reading the # -- Image tag... comment line in charts/kates/values.yaml and passing ghcr.io/bmscomp/kates:-- to Trivy (404 every week).
   • rescan-released gated on CRITICAL,HIGH (exit-code: "1"), whereas ci.yml and all publish-*.yml workflows report HIGH and fail only on CRITICAL.
   • Running notify-scheduled-failure inside each of the 3 matrix legs posted 3 simultaneous comments per failed schedule run (and hit GraphQL races).

What changed

• README.md: Add the katesplatform.io badge and top navigation link, tighten the Fault injection bullet while linking Chaos in practice for provider coverage and custom experiments, and update the make cli-install note under Building from source.
• Makefile: Guard xattr and codesign in cli-install behind uname -s = Darwin so Linux installs exit 0 and run the PATH check.
• .github/workflows/security.yml: Scan forward to tag: when resolving the kates image pin (and reject malformed/flag-like tags), report CRITICAL,HIGH in logs while gating on CRITICAL to match release policy, and move notify-scheduled-failure to a single downstream notify-failure job.

Closes #264