docs: report-first README polish

[AnobleSCM]

Presentation only. Zero behavior changes — no code, no version bump, no publish, no package-contents change, no repo settings touched.

1. Demo visual above the fold

assets/devcat-report.svg now sits directly under the intro line.

The content is real output, not a mock-up: the built CLI was run against a small curated demo machine (a clean HOME with a representative tool set), captured through a PTY so colour was emitted, and rendered to a static SVG. It is labelled "Example output" in the README because the machine is curated rather than anyone's real one.

Two things worth noting:

• The fenced text block that was already in Quickstart turned out to be byte-identical to this capture (diff clean, including the 13 locations checked / 2 project-scoped · 21 user-wide footer). No numbers were invented or adjusted. That block is retained inside a <details> as the text fallback for screen readers and text-mode viewers.
• The image is referenced by GitHub raw URL, so it renders on npm as well as GitHub. assets/ is outside the package.json files allowlist, so it does not enter the tarball and the file count is unchanged. The raw URL resolves once this merges to main.

No terminal-recording tooling and no CI were added — the SVG was produced by a throwaway local script that is not part of this repo.

2. Comparison box

New section, "An inventory, not a security scanner", framed as different job, complementary — it closes by pointing readers at a scanner for safety questions. No vendor is named and nothing is disparaged; the scanner column is deliberately hedged ("often", "may").

Every DevCat cell was checked against source rather than asserted:

Claim	Where it is true in code
Lists what is installed	src/manifest/* → src/ui/report.ts
No account	runReport imports no auth module
No network on the default command	fetch exists only in src/api/client.ts, unreachable from the report path
Never executes an MCP server	no child_process/spawn/exec anywhere in src
Retains names only	the three parsers keep Object.keys(...) and nothing else

The DevCat column header is scoped to the devcat report so the "no account / no network" cells stay literally true given sync exists.

3. Sync docs consolidated near the bottom

All profile-sync and device-auth documentation now lives in one section titled "Profile sync — paused while devcat.dev is rebuilt", so the pause is visible in the heading itself. Moved in with it: the four sync-only environment variables and the Linux keychain troubleshooting entry (DEVCAT_DEBUG included — it only produces output on the sync and browser-open paths).

Nothing was deleted and no sync code was touched. The top of the README is now purely the local report. An explicit <a id="profile-sync"> keeps the pre-existing in-document link working regardless of heading punctuation.

4. Dead workflow removed

Deleted .github/workflows/agent-pr-gate.yml (407 lines), left over from the review gate decommissioned fleet-wide on 2026-07-24.

Verified safe before deleting: nothing in the repo references it, and the active agent-pr-gate-main ruleset carries no required_status_checks rule (only PR-required, linear history, no-force-push, no-deletion), so removing it strands no check. ci.yml — the 3-OS x 2-Node matrix — is untouched.

Heads-up for whoever merges: this touches .github/workflows/*, a protected path under the repo contract, which advises a panel second opinion before merge. Flagging rather than assuming.

Gates

All run from the worktree root (pwd-asserted):

Gate	Result
npm run lint	pass, clean
npm run build	pass
npm test	228 passed / 228, 31 files
npm pack --dry-run	67 files, 50.3 kB

File count is unchanged — a throwaway origin/main worktree was built and packed for comparison and also reported 67 files (49.5 kB). The +0.8 kB is the larger README alone; assets/ is excluded by the files allowlist. Tarball accounting: 64 dist/ + README.md + LICENSE + package.json = 67.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.