docs: cut the README to the sixty-second surface

A human review found the README far too long. It was 1683 words, with the Verification section at 662 and Variants at 509, because every review since the fork landed another paragraph of nuance in the file a reader meets first. It is now 719 words and reads as a standing document: what the project is, the variants table, pull and verify, where the rest lives.

Every paragraph that left was classified before it moved. Thirteen already existed in SECURITY.md or the site and are now reached by link (runtime posture, FIPS mechanics, the debug parity caveats, three of the four cosign blocks). Five were principles present nowhere else and moved into SECURITY.md in the same register: the local scripts/verify-reproducibility.sh procedure under ## What the pipeline produces, and the predicate extraction plus grype --vex and trivy image --vex commands under ### Unfixable module findings. Three were snapshot measurements (Trivy and Grype finding counts, the eleven-statement derivation) and are deleted; the CHANGELOG and the statements file carry them.

CONTRIBUTING gains ## Where a fact goes: README under 800 words with no measurement or scanner output, SECURITY.md owns every security claim once, the site owns the narrative, CHANGELOG bullets are a bold lead plus at most two sentences. That is the rule that keeps the cut from growing back.

Two graphics. site/build-flow.svg draws the four-stage flow (upstream tag, UBI9 build, attest, publish) under ## Lineage, with the paragraph trimmed to what the picture cannot carry; the site's inline copy is matched to it and the pairing is recorded in the variant checklist. The hero's two stale lines now say built in UBI9 and shipped from scratch, and name OpenVEX; hero.png is re-rendered with the same rasteriser at the same size.

Checks: presentation standard 13 of 13, security-md 4 of 4, every README anchor into SECURITY.md and CONTRIBUTING.md resolves, check-versions.sh passes with the README's anchored pins up from eight to nine (the tag-scheme example is now a pin the release script moves), vale alerts down from nine to seven, both SVGs well-formed.