Audit: make the front page true again, and say how this was built

[Tippel-AI]

The documentation half of the launch audit. Follows #34 and #35.

The two that were my fault

MPF-M-002 was missing from the rule table, and a scope limit still denied it.
Same cause: PR #32 made three README edits in one script, the third assertion
failed, and nothing was written. I fixed the third separately and never checked
the first two had landed.

So the front page listed six rules while seven shipped, and said

Not yet checking the C2PA marking of web pages

…twelve lines above an example config containing type: document, which
configures exactly that.

The guard could not catch it. It asserted documented ⊆ shipped but not the
reverse, and matched rule ids anywhere in the file rather than inside the table —
so a deleted row still passed, because the same id appeared in the scope limit
denying it. Both directions now, scoped to the table, and mutation-tested: removing
the row turns the suite red.

The table gained a severity column

Rule	…	Fails the build?	…
MPF-D-001		yes
MPF-D-002		warns

A reader deciding whether to put this in CI needs to know two rules warn rather
than fail — and why: the obligation is real, the judgement is not a string
comparison.

The transcript, re-captured

It predated three behaviour changes. The new one is better advertising than the
old:

MPF-L-001  SKIP    images  no perceivable text to inspect for a label — a media
                           endpoint returns an API payload, not the page where
                           the content is shown. Point a 'ui' probe at that page
                           to check this obligation.
MPF-T-001  SKIP    chat    18 tokens is below the 100 needed for a meaningful
                           score — the detector's confidence grows with length,
                           and a short sample would be noise dressed as a verdict

Two refusals to guess, in the tool's own words.

Two things a hostile reader would have said

"Where is the document that admits this is one person's reading of an ambiguous
regulation?" It exists — 884 lines of it — and nothing pointed at it. Now linked
from the README with an English preface. The body stays German: that is the
language the sources were read in, and a translation would put a second
interpretation between the reader and the argument. The paragraph numbers are the
part that matters and they are language-neutral.

"How was this built?" The commit history makes the pace obvious, so it is
better said than inferred. The README now says it plainly, along with what that
changes and what it does not — and points at the two documents where the judgement
calls are open to inspection.

Also

• A contributor path from the README.
• The empty negative-test scaffolding replaced with a table of where those cases
  actually live. "Where are the negative tests" is a fair question to ask a
  compliance tool, and the answer should not be "grep for it".
• The pre-0.1.0 self-audit marked superseded, not deleted — deleting a stale
  record is the habit this project argues against everywhere else.
• Internal launch drafts out of the public docs directory.
• CITATION.cff no longer claims Apache-2.0 for material that is CC-BY.
• markproof init no longer stamps someone else's SPDX header onto the user's config.
• The WeasyPrint renderer carries the Article 50(2) two-limbs note the other two had.
• Repository homepage set.

524 tests, ruff + mypy strict clean.

🤖 Generated with Claude Code