fix(audit): corroborate custom-subject squash merges

[200lz]

Summary

• repair the public-release identity audit for GitHub squash merges whose custom commit subject omits the usual (#N) association
• preserve the existing fully offline path for ordinary squash subjects
• add bounded, unauthenticated, read-only GitHub corroboration with fail-closed repository, PR, topology, actor, signature, signer, and identity bindings
• simplify the root README so first-time users can understand OMIV's purpose, capabilities, users, quickstart, and real-world validation more quickly

Root cause

PR #5 passed all pull-request CI checks because the pull-request event supplied identity evidence.

The subsequent main push failed because its squash merge used a custom --subject, omitting the usual terminal (#5) association. Without pull-request event context, the audit could not associate the otherwise valid GitHub-signed author/committer pair and correctly failed closed.

Security boundaries

• signature or main reachability alone is never sufficient
• exactly one merged same-repository PR association is required
• repository identity, base branch, result/base/head/tree topology, actors, signature reason, signer key, and reviewed identity fingerprints must agree
• malformed, ambiguous, missing, contradictory, or unavailable corroboration fails closed
• no GitHub credentials or tokens are read
• no owner, publisher, maintainer, release, or repository authority is inferred
• the existing offline (#N) association path remains unchanged

README

The README is reduced from approximately 15 KB to 9 KB while preserving:

• offline-first and fail-closed positioning
• current Phase 5 and Phase 6A–6E capabilities
• the 30-second quickstart
• the Unsloth case study and acknowledgement of Daniel Han
• reproducibility, fidelity, runtime, safety, and endorsement boundaries
• documentation, roadmap, security, contribution, license, and open-core links

Validation

• focused identity tests: 24 passed
• complete offline suite: 1,898 passed; 8 disabled integrations skipped
• identity audit: unverified_platform_claims=0 unknown=0 invalid=0
• compilation, lint, formatting, publication audits, launch audit, JSON parsing, privacy scans, and git diff --check passed
• Unsloth case-study checksums remained unchanged