Document config loading, cgo policy, and tagging policy in README

README.md

@@ -48,9 +48,13 @@ sutil generate mnemonic > mnemonic.txt
 sutil cbk derive < mnemonic.txt
 sutil cbk derive --public < mnemonic.txt
 
-# Build metadata.
+# Build metadata, including which config file (if any) was loaded.
 sutil version
 sutil info
+
+# Every command first loads ~/.sneak.yaml (or .json, .toml, ...) if it
+# exists, or the file named with --config.
+sutil --config ./sneak.yaml info
 ```
 
 ### Use the packages
@@ -138,7 +142,13 @@ of the module stays small and intentional.
 
 The command tree holds no global state: `cli.New` builds every command from a
 `Params` struct, so tests construct it repeatedly with captured input and
-output, and nothing happens in `init` functions.
+output, and nothing happens in `init` functions. Before any command runs, the
+root command's persistent pre-run loads the optional configuration file (the one
+named by `--config`, or else `.sneak.*` in the home directory found with
+`go-homedir`) into a viper instance that also exposes environment variables. No
+command consumes settings from it yet; `sutil info` reports which file was
+loaded. Tests point `Params.ConfigDir` at a temporary directory so the real home
+directory is never read.
 
 ### `pkg/cbk`
 
@@ -226,11 +236,11 @@ sutil
 
 ### Build, test, and CI
 
-The `Makefile` is the single entry point: `make test` (30-second timeout, race
+The `Makefile` is the single entry point: `make test` (30-second timeout, quiet
-detector, quiet unless something fails), `make lint`, `make fmt` and
+unless something fails), `make lint`, `make fmt` and `make fmt-check` (gofmt for
-`make fmt-check` (gofmt for Go, prettier for markdown), `make check` for all
+Go, prettier for markdown), `make check` for all three, `make build`,
-three, `make build`, `make install`, `make docker`, `make hooks`, `make tidy`,
+`make install`, `make docker`, `make hooks`, `make tidy`, and `make setup` to
-and `make setup` to install the pinned prettier.
+install the pinned prettier.
 
 `make lint` runs golangci-lint inside the same hash-pinned Docker image the CI
 build uses, so local results match CI exactly. The `Dockerfile` splits
@@ -240,7 +250,12 @@ on both. The runtime image carries the binary and the source it was built from.
 Every external reference, from base images to the GitHub Action in
 `.gitea/workflows/check.yml`, is pinned by content hash with a version and date
 comment. `.golangci.yml` is the standard configuration and is never edited by
-hand here.
+hand here. cgo stays off: the Makefile exports `CGO_ENABLED=0` for every build
+and test, so binaries are static and no C toolchain is needed anywhere.
+
+Version tags are created by the author alone, when the author decides. Tooling,
+contributors, and agents working in this repository do not propose, schedule, or
+create tags.
 
 ## Development
 
@@ -254,7 +269,6 @@ make docker     # the full CI build
 
 ## TODO
 
-- [ ] Tag `v0.1.0` once `main` is green in CI.
 - [ ] Bump the pinned `golangci/golangci-lint` image (in `Makefile` and
       `Dockerfile`) past v2.12.2 once the canonical `.golangci.yml` disables
       `exhaustruct_v5`, which v2.13.0 added alongside the already-disabled