Add the README's required sections and clear stale TODO.md items (closes #46)

README gains Description, Getting Started, Rationale, Design, TODO and
License sections; its first sentence names the licence and author.
Installation and Quick Start become Getting Started; Core Architecture
becomes Design, whose two false version bullets (symlink switching,
unencrypted metadata) are corrected. The README is rewrapped to
prettier's settings.

TODO.md: Next Step points at the 1.0.0 milestone, its four finished
items move to Completed Steps with their dates, and Future Steps loses
the items already done.

Model: opus-5-5

TODO.md

@@ -10,18 +10,13 @@
 
 # Status
 
-pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in
-flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).
+pre-1.0. No git tags. Open work is tracked on the issue tracker, which is
+authoritative.
 
 # Next Step
 
-Bring the repo into policy compliance in one commit:
-
-- Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/
-  docker already exist).
-- Add REPO_POLICIES.md and .editorconfig.
-- Add .gitea/workflows/check.yml running make check.
-- Verify Dockerfile base images are pinned by sha256.
+Take the next open issue in the `1.0.0` milestone:
+https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
@@ -266,8 +261,15 @@ Bring the repo into policy compliance in one commit:
   `findUnlockerIDByMetadata` now returns an error so `unlocker list`
   skips an unreadable `unlockers.d` entry with a warning instead of
   emitting a fabricated fallback ID.
+- 2026-08-07: Added `.editorconfig`
+  (https://git.eeqj.de/sneak/secret/issues/27).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
+- 2026-07-07: Added `REPO_POLICIES.md` and the `make hooks` target;
+  `.gitea/workflows/check.yml` now runs `script/cibuild`.
+- 2026-03-30: Added the `make fmt-check` target and
+  `.gitea/workflows/check.yml`, which runs `docker build` on every push; the
+  `Dockerfile` base images are pinned by sha256.
 - 2026-03-11: Secure Enclave unlocker for hardware-backed secret
   protection, plus review fixes (stub panics, derivation index, tests,
   README) on branch secure-enclave-unlocker.
@@ -289,8 +291,6 @@ Bring the repo into policy compliance in one commit:
 
 # Future Steps
 
-- Compliance (after Next Step lands): keep main green under the new
-  .gitea workflow; run make check before every merge.
 - Implement version-number shell completion for the second arg of
   `secret version promote` and `secret version rm`
   (`internal/cli/version.go`; was an in-code TODO removed for godox).
@@ -302,23 +302,10 @@ Bring the repo into policy compliance in one commit:
   tests) are not linted on the Linux CI runner and still contain lines
   over the new 88-column limit; they will surface if lint ever runs on
   macOS.
-- Merge secure-enclave-unlocker to main once review is done.
 - 1.0 critical security blockers (from repo TODO.md):
-    - Command injection: GPG key IDs passed unescaped to exec.Command
-      (pgpunlocker.go:323-327); data.String() passed unescaped to the
-      security command (keychainunlocker.go:472-476).
-    - Memory security: age identity .String() creates unprotected
-      copies (keychainunlocker.go:356, pgpunlocker.go:256,
-      version.go:155); age secret key held in a plain string in
-      cli/crypto.go:86,91,113; private keys exposed via buffer.Bytes()
-      to GPGEncryptFunc and EncryptWithPassphrase.
-    - Input validation: no maximum secret size (DoS).
-    - Timing attacks: bytes.Equal passphrase compare (cli/init.go:
-      209-216); non-constant-time public key compare (vault.go:95-100).
-- High priority:
-    - Secure temporary file handling and cleanup.
-    - Initialize a default unlock key at vault creation.
-    - Add secret rm and vault deletion commands.
+    - Memory security: age identity .String() creates unprotected copies of
+      private keys; the call sites are listed in
+      https://git.eeqj.de/sneak/secret/issues/38.
 - Medium priority:
     - Standardize error messages; stop leaking internals.
     - Graceful handling of corrupted or missing key files with recovery