Burnish: project page, proof section, changelog, release tripwire

[lroolle]

Packaging pass. No behaviour changes to bwg itself — everything here
is what someone meets before they run it.

Project page

docs/index.html, served from /docs on main: one page, no build
step, no JS. Name, the fleet table, install, sixty seconds, the reason
the safety model is shaped the way it is, and an honest "skip it if".

It also serves llms.txt at the site root so an agent that fetches one
URL gets the whole orientation. That copy comes from make docs, and
CI fails when it drifts from the repo's — the drift check is three
lines and is the only reason two copies are tolerable.

Needs a repo setting after merge: Pages → source main / /docs.

README

It opened with a demo and a safety claim and gave the reader no way to
check either. Now:

• badge row — does it build, is it released, where are the docs
• a Proof table pairing each claim with the command that verifies
  it (read-only gate, destructive-tier discipline, no-panic breadth,
  the key-masking invariant, the pinned bwg ls output). Every command
  in it was run before it was written down.
• when to skip it — one VPS with the panel already open does not
  need this, and KiwiVM has no billing endpoints so bwg will never grow
  them
• generous credit to strahe/bwh, which is the better choice if you
  want a library and none of the CLI

Release tripwire

install.sh and bwg update fetch assets by exact name. A change
to .goreleaser.yaml's name_template would break self-update for
every existing installation while the release job stayed green. The
release job now fails unless all six archives and checksums.txt are
present under the names internal/updater asks for (pinned on the Go
side by TestAssetName), and goreleaser is pinned to ~> v2 instead
of latest.

Also

CHANGELOG.md (Keep a Changelog; entries say why it matters), issue
templates that ask for bwg version and KVM-vs-OpenVZ — the two facts
every bug here needs — and a PR template whose checklist is the repo's
actual rules (SKILL.md moves with JSON shapes; a destructive endpoint
states what it loses).

🤖 Generated with Claude Code