docs: make the registry-to-verified-BTC workflow clear

[PulseBet]

What changes

The README previously led with tool details, unpinned install commands, and a stale statement that npm 1.3.1 was not yet published. This change puts a complete first-use workflow first: install the registry-listed npm package, request a keyless BTC sample, and verify the unchanged signed receipt.

It also links prominently to the GitHub MCP listing, explains keyless versus developer access, pins the README's stdio examples to npm 1.3.1, and clarifies signature coverage, the public-key fetch, and the separate hosted-service lifecycle. Detailed integration and signature documentation remains available below the quickstart.

Only README.md changes. No runtime, dependency, package version, manifest, billing, or registry-record changes are included.

Publication and configuration verification

• GitHub MCP listing is live for io.github.PulseBet/pulse-verity.
• The official registry's latest active metadata record is version 1.3.2 and references npm pulse-verity@1.3.1.
• npm 1.3.1 is published, and its versioned GitHub release/MCPB is available.
• Package, MCPB, Cursor, Grok and Gemini configuration references were compared; the README now uses the same npm version. The registry metadata version is explicitly distinguished from the package version.

Validation

• git diff --check: passed.
• node scripts/words-test.mjs: passed (5 surfaces).
• Existing Cursor manifest checks: 7 passed; Grok: 4 passed; Gemini: 9 passed.
• Existing manifest-copy checks: 5 passed, 2 pre-existing failures, also reproduced on the unchanged base. The registry description says "offline", and the validator rejects the live registry's 1.3.2 metadata version paired with npm 1.3.1. Neither was silently changed to force a passing result.
• Packaging tests were attempted: 2 fail because this fresh worktree has no generated dist/index.js. No local production build was run; these are not successful packaging checks.
• Live existing Gemini smoke harness launched the actual published npm 1.3.1 from a clean temporary directory without an API key: tools listed, keyed batch access rejected appropriately, keyless BTC fetched, and the unchanged receipt verified with valid: true and recordValid: true. No feedback report was submitted.
• README's 7 local links/anchors passed. Seven external destinations returned HTTP 200, including the GitHub listing, developer portal, access guide and versioned release asset. npm's human-facing package page returned HTTP 403 to automated access; the npm registry API and actual package execution succeeded. A pricing URL HTTP check does not constitute a checkout or payment test.
• Independent static copy review: CLEAN. Signature verification is not presented as proof of price accuracy, freshness, or trading suitability.

Cloud checks on commit 8ad718f922fbaed05c91ef55f09880d40c9160b5 have completed:

• Claude plugin validation: passed.
• Gemini extension verification: failed on exactly the two pre-existing manifest-copy assertions documented above. Before that failure, TypeScript compiled, 202 self-test assertions, 112 agent-contract assertions, the vocabulary gate, and 20 keyless onboarding checks passed.
• The remaining tests after manifest-copy in the chained npm test command did not run in that workflow. The local static results above are recorded separately.
• Publication and published-asset verification jobs were skipped, as expected for a draft PR.

Release boundary

Draft for review only: do not merge, publish npm, deploy a service, or modify registry records as part of this task. A separate registry-copy correction and a decision about the metadata-version validator remain outstanding. A future npm release would be needed only to distribute the revised README inside the npm package itself; this PR does not require an npm publication to update the GitHub README after approval and merge.