docs(readme): name loadout as reference consumer of the mint path (lr-de6c5c)

[clagentic-builder]

What

Documents the loadout/gatekeeper integration from gatekeeper's side, which was previously undocumented. Before this change, clagentic-loadout's README referenced gatekeeper three times with a public link and seam framing; clagentic-gatekeeper's README referenced loadout zero times. A reader arriving at gatekeeper had no way to discover that loadout exists, that it is the reference consumer of gatekeeper's minting path, or how the two compose.

Changes

• README.md: new "Composes with" section, placed after "What this is NOT". Names clagentic-loadout as the reference consumer of gatekeeper's mint path via loadout's TokenProvider seam, states the optionality explicitly in both directions (a gatekeeper-only user loses nothing; a loadout user who never touches gatekeeper loses nothing), and explains the concrete seam mechanics (mint a scoped short-lived token per role; --json mode additionally returns the broker-verified App slug a consumer can adopt). Vocabulary mirrors loadout's own README (lines 28-39) rather than inventing a second description of the same relationship.
• docs/ROLES.md: one paragraph added to the existing "Returned identity: the verified App slug travels with the token" section, naming loadout as the reference consumer of that exact mechanism and cross-referencing the README's optionality statement instead of restating it.

What this is NOT

• No product code changes. Docs only.
• No Forgejo identity-mapping documentation added -- verified that on Forgejo the role name IS the login (native accounts, no App/bot projection), so no such mechanism exists to document.
• No private repo, internal tooling, or task-tracker ID referenced in any shipped surface (README, docs). Both projects are public; only the public GitHub URL and public seam vocabulary are used.
• Does not overstate the relationship into a dependency in either direction.

Coordination note (for Scope C / loadout docs/provisioning.md, still open)

The loadout side should describe the same mechanism as: loadout's TokenProvider seam optionally consumes gatekeeper's verified App slug (returned via --json / Token.AppSlug) as a resolution tier above its own github_app.slugs config, with config remaining the standalone fallback. This PR's README/ROLES.md wording is the gatekeeper-side anchor to cross-reference against so the two ends do not drift into two descriptions of one fact.

Test status

go build ./... and go test ./... pass (docs-only change; no code paths affected). No markdown-specific lint target exists in the Makefile.

Task: lr-de6c5c

[clagentic-reviewer]

PEACHES — clean (1 nit)

• README.md Composes with section para 1: typo double all word (peaches.nit.typo)

Factual accuracy verified:

• --json output shape confirmed in README Structured output section
• Gatekeeper mints scoped short-lived GitHub App token per docs/ROLES.md
• Forgejo standalone with static token confirmed in docs/ROLES.md
• No Forgejo identity mapping claimed (correct)

Vocabulary matches loadout/README.md:

• integrates rather than owns (exact phrase)
• seam with standalone in-package fallback (exact)
• never imports bring-your-own supported (exact)
• reference consumer and reference minting provider (consistent)

Duplication control:

• docs/ROLES.md Reference consumer cross-references README Composes with
• Does NOT restate mechanism (correct)
• Follows task instruction extend and cross-reference

Optionality both directions:

• Gatekeeper serves any consumer no loadout required
• loadout serves any TokenProvider no Gatekeeper required
• Forgejo standalone path named
• GitHub interchangeable provider named

Public surface:

• https://github.com/clagentic/clagentic-loadout verified correct
• No private repo names internal ids or hostnames

Docs-only verified: README.md and docs/ROLES.md only

{"reviewer": "peaches", "review_status": "clean", "head_sha": "24598863e3ac92d3551b97d9a233f44e4e1b9bb3", "pr_number": 28}

[clagentic-reviewer]

PEACHES — clean

Prior context: Reviewed at SHA 2459886, found one nit (doubled "all") on README line 48, now fixed. Re-reviewing at new SHA be6fbce per NAOMI gate binding verdicts to head SHA.

This pass: Diff confirms typo fix in place: "or no provider at all each work equally well" is grammatically correct and reads better (distributive across the three-item list). Cross-references to loadout (README "Composes with"/docs/ROLES.md "Reference consumer") are valid anchors. Optionality framing preserved: Gatekeeper users don't require loadout; loadout users don't require Gatekeeper. Prose is clean. No findings.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "be6fbceddfc5debb0c176aa7380191645ba0233f", "pr_number": 28}

[clagentic-security]

BOBBIE — clean

PR #28 is genuinely docs-only: README.md (+26) and docs/ROLES.md (+7), 33 insertions, 0 deletions, no code/config/workflow files touched. Verified against 72a7126..be6fbce both via the GitHub read path and local git diff --stat (identical result).

Residual exposure checks on the new prose (public repo, credential-minting service):

• Disclosure: only public repo names (clagentic-gatekeeper, clagentic-loadout) and generic terms (broker, App slug, role). No internal hostnames, installation ids, private repo/tool names, or task-tracker ids in shipped prose.
• Credential-bearing examples: the --json shape shown, {"token": "...", "expires_at": "...", "app_slug": "..."}, is pre-existing text using literal ellipsis placeholders — not a real-looking token/key, and not part of this PR's added lines.
• Security-misleading guidance: no instruction to log/echo/persist a minted token. The App-slug binding (gate 2) is described as required and fail-closed, never optional or bypassable.
• Integration framing: trust direction is correct — consumer calls gatekeeper, adopts the broker-verified App slug gatekeeper returns. No inversion implying gatekeeper should trust consumer-supplied identity.

gitleaks run against working tree: no leaks found. No code changed, so semgrep/osv-scanner have no reachable sink to scan.

Zero findings. Clean audit.

scanners_run: gitleaks (no leaks found); semgrep/osv-scanner not applicable (no code files in diff)

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "be6fbceddfc5debb0c176aa7380191645ba0233f", "pr_number": 28}

[clagentic-merger]

Merged via clagentic-loadout v0.2.0

Field	Value
Gated HEAD SHA	be6fbceddfc5debb0c176aa7380191645ba0233f
Merged SHA	be6fbceddfc5debb0c176aa7380191645ba0233f
Reviews	clagentic-reviewer[bot], clagentic-security[bot]
CI status	no-runner-by-design (0 commit-status entries at HEAD)
task_id	lr-de6c5c