Document the Krad package boundary and workflow

[keys-i]

Closes #4

Motivation

Describe the implemented boundary precisely without presenting metadata-only packages as completed toolchains.

Changes

• show the four-package dependency graph
• document plan, source verification, and test commands
• state that upstream source is pinned but not vendored
• keep packages private until compiler/sysroot artifacts and browser runtime contracts are built and tested

Verification

• README commands match the executable CLI and package script
• npm test passed: 3 tests, 3 passed, 0 failed
• node tools/krad.js verify ../research --json passed for all four sources
• git diff --check bootstrap..docs passed

Risk and rollback

Documentation changes behavior only through user expectations. Roll back by reverting commit 344607f.

Stack

Depends on the tests PR; base: tests. This is the top of the current stack.