docs: update README

[mbevc1]

Expand the minimal root README into a proper front door for the repo:

• Turn the one-line description into a short "what it does" overview listing the CLI's key capabilities (fingerprinting, attestations, environment snapshots, compliance assertions).
• Add an Installation section with copy-paste blocks for the shell installer, Homebrew, npm, Docker, and building from source, plus a note on the available deb/rpm packages.
• Keep the existing badges and the four reference links, and continue to link out to the docs site, developer guide, and public trails rather than duplicating them.
• re-order PR template

Checklist

• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed
• Docs are autogenerated from CLI help — make sure the help text reflects your changes

[claude]

Claude finished @mbevc1's task in 1m 22s —— View job

---

Review: docs: update README

• Read PR diff and current README
• Verify install commands against the repo
• Confirm earlier deb/rpm feedback was addressed
• Post review

I reviewed this as a docs-only change, so the Go static-analysis phase (go build / go vet / go mod tidy) doesn't apply — no code changed. I focused on whether the new install instructions are accurate and consistent with the repo, and cross-checked each one:

Everything checks out ✅

Section	Verified against
Install script + sh -s -- v<X.Y.Z>	install-cli.sh parses a positional version arg and strips the leading v (VERSION_FILENAME=$(echo "$VERSION" | sed 's/^v//')), so the tag form is correct.
Release-binary archive naming (kosli_<X.Y.Z>_<os>_<arch>.tar.gz / .zip)	Matches the download URL the script builds exactly.
brew install kosli-cli / brew upgrade kosli-cli	Matches formula name in install-cli.sh, and CI runs the identical command (.github/workflows/install-script-tests.yml:64) with no tap step — so the bare command is right.
npm install -g @kosli/cli + the "no npx" caveat	Package name matches npm/wrapper/package.json; the esbuild-style optionalDependencies pattern (npm/README.md) is exactly why npx skips the platform binary. Good, non-obvious detail to call out.
Docker ghcr.io/kosli-dev/cli	Consistent with the release pipeline.

Earlier feedback resolved: the orphaned .deb/.rpm note that was previously sitting under Build from source has been folded into Download a release binary (README.md:61) in commit c878b8c2, and the duplicate is gone. 👍

PR template reorder moves the "Docs are autogenerated" item to the top — reasonable, since it's the item most likely to be forgotten.

Minor optional polish (non-blocking):

• The badges (line 1–4) don't include the license row's alt-text issue or anything — no action needed.
• Consider whether the Install script section should note it installs into a PATH dir that may require sudo (the script picks a target dir automatically), but this is already implied and the docs link covers the full detail.

Nice work — this turns a one-line README into a genuinely useful front door, and each install path is factually correct against the tooling. No changes requested.
· 20260728_readme