docs: the public-scan surface, and seven more lessons for the log

[bgard68]

Documentation catch-up for everything that shipped today.

README

The public-scan feature is now shown the way it lands hardest: the deployed instance scanning its own repository — 7 workflows, 4 clean, 3 findings, each a registered, test-enforced exception. New screenshot (04-public-repo-self-scan.png) captured from the live deployment via Playwright; no OpenAI credit spent, unlike the full capture script, because the public tab needs none.

Demo guide

New step between the scenario walkthrough and exports: scan a repository the audience picks. If they hesitate, scan this repository itself — three documented findings close harder than a clean report.

Engineering log: 18 → 25 entries

Each in the established shape (what was wrong / how found / why nothing caught it / what changed / what prevents recurrence):

#	Lesson
19	A rule demanded a setting GitHub rejects — the golden corpus caught a false positive on its first run
20	Deploy was dead for a week and reported nothing — Actions allowlist vs Dependabot, startup_failure has no logs
21	The deploy gate measured the wrong instance, twice — liveness vs readiness, then the outgoing process answering ready
22	A stale response wiped newer results — effect guard runs at start time, promise resolves later
23	Endpoint options no test host could influence — pre-Build() config snapshot vs DI
24	The strongest claim ran only in production — the OpenAI transport seam
25	A fix that traded one silence for another — no empty catch blocks, house rule, CodeQL-enforced

Docs and one PNG only; no code changes.