Restructure the README to the portfolio standard

[adamXbot]

Brings README.md into the shared portfolio structure: hero, badge row, fenced disclosure block, then overview / what it does / get it / docs / contributing / licence.

Wrong facts removed

• Mangled one-liner. The description read "Self-hostable mantis key service" — apparently a find/replace that ate the word "canary". Restored to "Self-hostable canary key service", which is what the docs source calls it.
• Stale version numbers in prose. The beta warning claimed "CLI v0.1.6, full server v0.1.1, edge v0.1.3 at time of writing". Actual versions on main are CLI 0.2.0 and edge 0.1.4 — two of the three were wrong. Prose version numbers are now gone entirely; the release badge carries the version so it cannot drift again.
• The "80+ notification channel" claim on the Uptime Kuma bullet was an assertion about Kuma, not about this repo, and is not verifiable here. Rewritten to say only what Mantis does (a per-key status URL that flips on hit).
• The "9-file honey-directory .zip" count could not be confirmed from the source, so the count was dropped. The .zip artefact itself is real and stays.

Links

• Eight links to privacykey/mantis-docs — that repo has been renamed to privacykey/docs-mantis. They resolved only through GitHub's rename redirect, which is not a guarantee. All eight repointed at the real name.
• No live docs site. docs.json in the docs repo defines no domain, and neither docs.privacykey.org nor mantis.privacykey.org resolves. The README now says plainly that the rendered site is not live yet and links the Markdown on GitHub, rather than implying a docs host exists.
• Every remaining relative path and URL across all four files was checked: all resolve, nothing 404s.

Badges

Replaced the ad-hoc row with the four standard badges. Each was verified to render a real value rather than "no status" / "not found":

Badge	Renders
status	status: Active
release	release: cli-v0.2.0
licence	licence: MIT
ci	ci: passing

ci.yml does run on main (on: push: branches: [main]) and has green runs there, so the CI badge is genuine. The decorative Homebrew and Cloudflare Workers badges were dropped — the brew install line is in "Get it" and the edge worker has its own paragraph.

The status badge currently resolves, but note it reads from the privacykey/.github hub; if the status-hub PR is still in flight it may briefly render "resource not found". The path is correct.

Kept deliberately

The HTTPS-only warning is preserved as its own block immediately below the disclosure. It makes a different claim to the pre-1.0 notice and is deliberately not merged into it.

Size

README.md 9702 → 6625 bytes. Nothing was deleted; the long-form material moved:

• CONTRIBUTING.md (new) — run from source, the full CI job matrix, the three test tiers, benchmarks, versioning. Records that pnpm is the only supported package manager and that CI reads the pinned version from packageManager.
• docs/GETTING-STARTED.md (new) — both quickstarts, bootstrap admin key, the one-command Fly.io launch, edge caveats, component index.
• docs/FLEET-PROVISIONING.md (new) — idempotent external_id minting and enrollment-scoped API keys.