docs: rewrite the tour and README as verified, terse reference

[ttncode]

What this changes

• Rewrites docs/tour/01–09 as terse reference: the four required headings, tables and bullets, relevant diagrams embedded. Narrative moved out; one lesson became a bullet in docs/runbook/ci-is-red.md.
• Every claim was checked against the code. Wrong statements fixed, for example: the toolbox unit job runs mise run ci-unit; the branch ruleset sets no required status checks; the 06 delete test does fail (check-paths.mjs runs in lint and check); "Try it" commands used node, which the toolbox does not have.
• README.md down to pitch, install, synopsis, tiers, services and links. Command detail and environment variables live in docs/README.md#commands; the reading path lives only in docs/README.md. The synopsis adds publish --private and list [--adapters] [--services].
• README no longer claims scaffold runs through a symlink: it does not (test fixtures rely on that by design, see 4d02b05). It shows a PATH install instead.
• CONTRIBUTING.md and SECURITY.md tightened.

How it was verified

• Per-page claim tables (claim, evidence file:line, verdict); an independent review re-checked the claims and looked for facts lost without a home. Two lost facts were restored (Redis CacheModule wiring, the DynamoDB exclusion).
• bats tests/documentation.bats 5/5, mise run test-unit 204/204, mise run lint clean.

Checklist

• mise run lint passes
• mise run test-runner passes — docs only; CI runs it
• New behaviour has a test that fails without the change — docs only, no behaviour change
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes