chore: clean npm tarball, restructure README for sellability, add July metrics

[shahboura]

Summary

• Tarball cleanup — .opencode/package-lock.json and .opencode/package.json no longer ship in the npm tarball. These dev-only plugin dependency files were scanned by Socket.dev, which flagged Apache-2.0 transitive deps and docked the license score to 70 despite MIT licensing. Fixed by replacing the wildcard "files": [".opencode"] with explicit subdirectories.
• README restructure — moved cache efficiency stats to 2nd section (was near bottom), added a 30-second demo, collapsed the 10-command install block into 1 command + <details>, trimmed verbose behavior notes, moved permission YAML into <details>, and rewrote the agent "Best For" column from role labels to action+outcome.
• July metrics — added July column to the efficiency table (145M cache hits, 98.2% hit rate, 1,016 requests). Combined 3-month hit rate now 97.3% across 2,803 requests.

Validation

• npm run doctor — 17/17 passed
• npm run lint:md — clean
• npm pack --dry-run — 105 files (was 107), 104.3 kB (was 108.8 kB), dev lock files excluded

Agent Behavior & Policy Impact

• No agent behavior/policy changes
• Agent prompt/instruction behavior changed
• Agent permissions changed
• Command routing/metadata changed
• Skill scope/allowlist changed

Risk & Rollback

• Risk level: medium
• Rollback approach: revert commit 508009a. README changes are cosmetic. The tarball files change is additive — it removes files that were never consumed at install/runtime, so no functional regression is possible.