docs: correct the README against the code, and tag Revyl links for attribution

[ethanzhoucool]

The README was behind the last several merged PRs, and a few things in it were wrong rather than just missing.

Fixed drift:

• preflight --verify was undocumented. The CLI prints a tip about it on every run.
• --exit-code was only documented for playscan. It is on preflight and verify too, and it is the right answer for the CI section, which still used a jq hack.
• The CRITICAL/HIGH/WARN/INFO ladder was never written down. HIGH shipped in Tier 0: verdict integrity (HIGH tier, --exit-code, scanner fixes) #6; the Claude Code section still said "CRITICAL, then WARN, then INFO".
• The codescan list claimed "30+ code patterns" and put several rules at the wrong severity. It is 24 rules and about 60 patterns. Now grouped by the severity each rule actually emits, checked against the code, with webview-only, missing-privacy-keys and console-log added.
• The crypto 3.1.5(b) rules from feat(codescan): detect crypto apps and flag Guideline 3.1.5(b) obligations (wallet org-account + exchange licensing) #14 were missing.
• verify's Android support, --artifact upload, --open, and the .app / .apk artifact rules were missing.
• The inline // greenlight:ignore directive was missing from the config section.
• The output-format section said all scan commands support terminal/json/sarif. privacy has no --format, ipa/playscan/verify are terminal+json, scan has junit.
• playscan was missing from the architecture tree.
• Added the /plugin marketplace add path now that .claude-plugin ships.

Every flag and command in the new README was diffed against --help output. Every severity claim was diffed against the rule definitions.

Editing pass on top: 45 em dashes to 0, 34 bold spans to 1, and the padding trimmed.

---

Second commit: Revyl attribution + CTA.

Every Revyl link in the README was untagged, so traffic off a 2.3k-star repo landed unattributed. Now tagged with utm_medium=readme and a per-placement campaign, following the pattern #13 set for the CLI.

• Reframed the runtime tier. The intro led with "it needs an account and it is opt-in", which sells against it. It now leads with what verify catches and discloses the requirement after.
• New section, "Where a static scan stops": the honest ceiling of text matching, with three concrete flows that ship GREENLIT and get rejected anyway. Lands on verify --dry-run, which is free, needs no account, and works with the revyl CLI absent.
• Two-minute setup block in the verify section, and a --verify CI gating example.
• Badge row and a footer with an actual next action.

--dry-run was tested with the revyl CLI off PATH to confirm the "no account needed" claim. An earlier draft had a REVYL_API_KEY env var in the CI snippet; greenlight has no such variable (auth is delegated to the revyl CLI), so it was removed.