docs(blast,surface): link cc-taskrunner as reference integration

Both packages are now powering downstream integrations in cc-taskrunner
(Stackbilt-dev/cc-taskrunner#21, #22). Added "Downstream integrations"
sections to both READMEs pointing at the taskrunner as a real-world
example of wiring these primitives into a governance workflow.

blast:
- Documents cc-taskrunner 1.5.0's 4-level severity ladder with gate
  behavior table
- Explains the auto_safe downgrade on critical severity
- Points at compute_blast_radius() in taskrunner.sh

surface:
- Documents cc-taskrunner 1.4.0's mission brief fingerprint injection
- Mentions the 80-line cap and graceful no-op behavior
- Points at build_fingerprint() in taskrunner.sh

Both sections help readers understand how these zero-dep analysis
packages compose with real autonomous-agent workflows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Kurt Overmier

packages/blast/README.md

@@ -104,6 +104,23 @@ Resolves a single import specifier to an absolute file path, or `null` for bare
 - **Code review automation** — surface hot files to reviewers who might otherwise miss architectural impact
 - **Self-improvement bots** — require blast radius <N before auto-queueing fix tasks
 
+## Downstream integrations
+
+### cc-taskrunner — autonomous agent safety gate
+
+[cc-taskrunner](https://github.com/Stackbilt-dev/cc-taskrunner) runs Claude Code in unattended sessions to execute queued tasks. Starting in **1.5.0**, it calls `charter blast --format json` on files referenced by each task prompt and classifies the result on a 4-level severity ladder:
+
+| Affected files | Severity | Behavior |
+|---|---|---|
+| 0–4 | `low` | silent |
+| 5–19 | `medium` | silent |
+| 20–49 | `high` | warning injected into mission brief |
+| 50+ | `critical` | warning injected; **`auto_safe` execution refused** |
+
+Critical severity downgrades `auto_safe` tasks to "requires operator approval" **before** spawning Claude Code, preventing catastrophic blast-radius changes from silently landing in autonomous pipelines. Thresholds are tunable via `CC_BLAST_WARN` and `CC_BLAST_BLOCK` env vars.
+
+This is the reference implementation for wiring `@stackbilt/blast` into a governance workflow. See [cc-taskrunner/taskrunner.sh](https://github.com/Stackbilt-dev/cc-taskrunner/blob/main/taskrunner.sh) — look for `compute_blast_radius()` and the "Blast radius preflight gate" comment block.
+
 ## Requirements
 
 - Node >= 18

packages/surface/README.md

@@ -113,6 +113,16 @@ Renders a surface as a compact markdown summary suitable for injection into AI c
 
 Any router with the `router.METHOD('/path', handler)` pattern will work; only the framework label depends on import detection.
 
+## Downstream integrations
+
+### cc-taskrunner — mission brief fingerprinting
+
+[cc-taskrunner](https://github.com/Stackbilt-dev/cc-taskrunner) runs Claude Code in unattended sessions. Starting in **1.4.0**, it calls `charter surface --markdown` on the target repo and injects the result as a `## Project Context (auto-generated)` section in every mission brief. This gives the agent an immediate routes + schema map so it doesn't burn exploration turns figuring out the codebase layout.
+
+Output is capped at 80 lines to protect the prompt budget, and the whole feature no-ops gracefully when charter isn't installed. Opt out via `CC_DISABLE_FINGERPRINT=1`.
+
+See [cc-taskrunner/taskrunner.sh](https://github.com/Stackbilt-dev/cc-taskrunner/blob/main/taskrunner.sh) — look for `build_fingerprint()` and the "Project fingerprint" comment block.
+
 ## Requirements
 
 - Node >= 18