README sweep: close the documentation gap behind v0.8.0

[MoSLoF]

What

A sweep of every repo document against the running binary (usage text, checks registry output) and the source tree. docs/RELEASING.md, docs/PERFORMANCE.md, NOTICE.md, SECURITY.md, and docs/DECISIONS.md were all clean — the version-literal guard test (TestREADMEVersionLiteralsMatchPyproject) already passes at v0.8.0, and PERFORMANCE.md's "Baseline (v0.7.5)" header is a correctly-dated historical record, not a live claim.

README.md was describing roughly the v0.7.5 feature set — six increments and a whole ecosystem-surface arc behind. Every fix below was verified against the binary or source before editing, not assumed from memory.

Fixes

• Ecosystem table: PyPI was missing uv.lock/poetry.lock/pdm.lock/pylock.toml/Pipfile; npm was missing pnpm-lock.yaml/bun.lock; NuGet still described only the three legacy lockfiles, omitting the entire modern .NET surface (PackageReference, CPM, project.assets.json, etc.); the Go row falsely claimed install-surface was "not yet extracted" when it's covered go:generate/cgo-flag/init-evasion/package-runner/cache-attribution extraction since OPU-28.
• VC-check coverage: VC-002g/h/i/j and VC-012 were entirely absent from both the summary list and the Install-surface extraction section. Each gate class was checked against the actual check.Meta rather than asserted — caught a wording error of my own in the process (VC-002j was drafted as "reaches network/shell" before I checked; the code says "bundled native binary at import time").
• Missing entirely: the EPSS arc (-epss/-epss-gate), the post-expansion advisory pass, and the adjudication doctrine (-real-roots containment, RepoGuard --verify).
• Actively wrong: the "recognized manifest no adapter can resolve" example list named .csproj/.vcxproj/Pipfile as unresolvable — exactly the manifests fixed this session. Left as-is, this would tell a reader the opposite of what the tool now does.
• Roadmap: pnpm/Poetry/uv were listed under "⬜ planned, not implemented" — false, all three ship.
• Project layout: omitted internal/versiondrift, internal/ciactions, internal/securefs, internal/semver, internal/pep508, and tools/ entirely — all real directories referenced elsewhere in the same file.

Added

• An EPSS paragraph under Threat-intelligence tiers.
• A containment-adjudication paragraph under Coverage is part of the verdict.
• A full "Repo-open execution surface (RepoGuard)" section — the tool, --verify, the Miasma/Hades IOC feed, and the recommended quarantine workflow — which had no home in the document before.

Validation

• TestREADMEVersionLiteralsMatchPyproject still passes (neither version literal was touched).
• Every file path introduced in new prose (tools/ihbv-repoguard.py, tools/ihbv-authentic.sha256, docs/ioc-miasma-hades.json) resolves on disk.
• Markdown code-fence count is balanced (54, even).
• Full suite green (34 packages), gofmt clean. No Go code changed — documentation only.

Files

• README.md
• docs/DECISIONS.md — D-123.

🤖 Generated with Claude Code

---

Generated by Claude Code