docs: full mdBook site + GitHub Pages deploy; rewrite README as project front page

- docs/: an mdBook documentation site — thesis, architecture, measurement
  discipline, equivalence gates, agent loop, isolation/anti-reward-hacking,
  playbook, ROI, reproduce, roadmap, and the five case studies (pulled from
  their single source in results/ via {{#include}}). Builds clean (21
  pages).
- .github/workflows/docs.yml: builds mdBook and deploys to GitHub Pages on
  push to main (one-time setup: Settings → Pages → Source = GitHub Actions).
- README.md: rewritten as the project front page — the thesis, the verified
  results table, layout, quick start, how it stays honest, links to the
  book. Replaces the stale Phase-0-era text.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

docs/src/reproduce.md

@@ -0,0 +1,50 @@
+# Reproduce it yourself
+
+Nothing here is a screenshot. Every number regenerates from a pinned corpus
+through the same commands.
+
+## Prerequisites
+
+- Rust (stable) + `just`; `clang`/`cmake` for the C target; `valgrind` for
+  callgrind profiling. Nightly Rust for the sanitizer gate.
+- Targets are vendored fresh (their `workspace/` is gitignored); each
+  `targets/<name>/target.toml` has the `[fetch]` recipe.
+
+## The commands
+
+```
+just build / test / lint       # trust-layer workspace
+just aa [cmd]                  # A/A self-test — must be a null verdict
+just calibrate <cmd> <out>     # A/A false-positive + injection detection
+just gates <target>            # corpus pin + upstream tests + golden replay
+just verdict <t> <bin> ...     # gates + bench vs pristine baseline + ledger row
+just report <run-id>           # ROI report from a ledger row
+```
+
+Service mode (Phase 4):
+
+```
+just service <baseline-bin> <candidate-bin> <doc>     # interleaved p50/p99 CIs
+just service-calibrate <server> <doc> <out>           # latency A/A + injection
+just report <run-id> --service-json <json>            # latency + ROI report
+```
+
+The agent loop, behind OS isolation:
+
+```
+just isolation-check                    # 19 boundary checks, both modes
+scripts/agent-isolated.sh <target> <run-id>   # one unattended attempt, confined
+```
+
+## Auditing a result
+
+Every accepted win can be re-audited independently:
+
+```
+python3 scripts/audit-attempt.py <run-id>        # mechanical re-check
+python3 scripts/diff-fuzz-<target>.py <dir> 10000 <candidate-bin>   # 10k fuzz
+```
+
+The ledger itself is the record: `results/ledger.sqlite`, append-only,
+every attempt (win or loss) with its hypothesis, gates, bench evidence, and
+verdict.