Add the README's required sections and clear stale TODO.md items (closes #46)

README gains Description, Getting Started, Rationale, Design, TODO and
License sections; its first sentence names the licence and author.
Installation and Quick Start become Getting Started; Core Architecture
becomes Design, whose two false version bullets (symlink switching,
unencrypted metadata) are corrected. README and AGENTS.md are wrapped
to prettier's settings.

TODO.md: Workflow and Next Step point at the 1.0.0 milestone and the
next branch, the old Next Step's four finished items move to Completed
Steps with their dates, and Future Steps loses the items already done.

Model: opus-5-5

TODO.md

@@ -1,27 +1,20 @@
 # Workflow
 
-* branch (from `main`)
-* do the work in Next Step
-* move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
+- branch from `next`
+- do the Next Step: the next open issue in the `1.0.0` milestone
+- log it at the top of Completed Steps
+- commit (`TODO.md` changes in the same commit as the work)
+- push, and open a PR against `next`
 
 # Status
 
-pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in
-flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).
+pre-1.0. No git tags. Open work is tracked on the issue tracker, which is
+authoritative.
 
 # Next Step
 
-Bring the repo into policy compliance in one commit:
-
-- Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/
-  docker already exist).
-- Add REPO_POLICIES.md and .editorconfig.
-- Add .gitea/workflows/check.yml running make check.
-- Verify Dockerfile base images are pinned by sha256.
+Take the next open issue in the `1.0.0` milestone:
+https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
@@ -287,8 +280,15 @@ Bring the repo into policy compliance in one commit:
   `findUnlockerIDByMetadata` now returns an error so `unlocker list`
   skips an unreadable `unlockers.d` entry with a warning instead of
   emitting a fabricated fallback ID.
+- 2026-08-07: Added `.editorconfig`
+  (https://git.eeqj.de/sneak/secret/issues/27).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
+- 2026-07-07: Added `REPO_POLICIES.md` and the `make hooks` target;
+  `.gitea/workflows/check.yml` now runs `script/cibuild`.
+- 2026-03-30: Added the `make fmt-check` target and
+  `.gitea/workflows/check.yml`, which runs `docker build` on every push; the
+  `Dockerfile` base images are pinned by sha256.
 - 2026-03-11: Secure Enclave unlocker for hardware-backed secret
   protection, plus review fixes (stub panics, derivation index, tests,
   README) on branch secure-enclave-unlocker.
@@ -310,8 +310,6 @@ Bring the repo into policy compliance in one commit:
 
 # Future Steps
 
-- Compliance (after Next Step lands): keep main green under the new
-  .gitea workflow; run make check before every merge.
 - Implement version-number shell completion for the second arg of
   `secret version promote` and `secret version rm`
   (`internal/cli/version.go`; was an in-code TODO removed for godox).
@@ -326,34 +324,18 @@ Bring the repo into policy compliance in one commit:
   never run on them, so it would likely find more there than the line
   lengths. No macOS test runs in CI. A macOS runner would cover all of it
   (asked on https://git.eeqj.de/sneak/secret/issues/50).
-- Merge secure-enclave-unlocker to main once review is done.
 - 1.0 critical security blockers (from repo TODO.md):
-    - Command injection: GPG key IDs passed unescaped to exec.Command
-      (pgpunlocker.go:323-327); data.String() passed unescaped to the
-      security command (keychainunlocker.go:472-476).
-    - Memory security: age identity .String() creates unprotected
-      copies (keychainunlocker.go:356, pgpunlocker.go:256,
-      version.go:155); age secret key held in a plain string in
-      cli/crypto.go:86,91,113; private keys exposed via buffer.Bytes()
-      to GPGEncryptFunc and EncryptWithPassphrase.
-    - Input validation: no maximum secret size (DoS).
-    - Timing attacks: bytes.Equal passphrase compare (cli/init.go:
-      209-216); non-constant-time public key compare (vault.go:95-100).
-- High priority:
-    - Secure temporary file handling and cleanup.
-    - Initialize a default unlock key at vault creation.
-    - Add secret rm and vault deletion commands.
+    - Memory security: age identity .String() creates unprotected copies of
+      private keys; the call sites are listed in
+      https://git.eeqj.de/sneak/secret/issues/38.
 - Medium priority:
     - Standardize error messages; stop leaking internals.
     - Graceful handling of corrupted or missing key files with recovery
       suggestions.
-    - Validate GPG key existence before creating PGP unlock keys.
     - Split oversized CLI functions.
-    - mlock/munlock for sensitive allocations.
 - Cleanups: read statedir from environment or default instead of
   passing it around.
-- Enhancements: help examples, shell completion, colored output,
-  --quiet flag, name suggestions on miss, audit logging, hardware
-  integration tests (Keychain, GPG), naming consistency, vault
-  export/import, batch operations, search, secret metadata
+- Enhancements: help examples, colored output, --quiet flag, name suggestions on
+  miss, audit logging, hardware integration tests (Keychain, GPG), naming
+  consistency, vault export/import, batch operations, search, secret metadata
   (descriptions, tags).