docs(readme): rewrite around what an artifact is and how to boot it

[TheGreatAxios]

Summary

• README opens with one sentence saying what an artifact is, installs with a single npm add line, and shows the boot sequence with createArtifactDb's { db, close } destructured and close() on shutdown.
• The false "Runtime support" section (there is no bun export condition) and the "How it works" section that restated the mount sections are gone.
• Every mountArtifacts / mountWorkflowArtifacts option, including onArtifactCreated, decorate, uploadPolicy, maxBinaryBytes and maxContentChars, has a row in the README reference tables with its default.
• The sidecar section says plainly that the host binds the agent's hub credential to its hub token and that the run-scoped routes live at /api/workflow-artifacts.
• Contributor setup and the internals write-up (formerly ARCHITECTURE.md) live in CONTRIBUTING.md. SECURITY.md moves to .github/, where GitHub still surfaces it as the security policy.
• The hub-credential sentence matches the wording on HUB_CREDENTIAL_HANDLE in src/sidecar-bundle.ts.
• First PR of the stack docs(readme): rewrite around what an artifact is and how to boot it #25 → fix(uploads): store upload bytes per version #31, based on main.

Verification

• Docs only, plus one comment in src/schema.ts. bun run typecheck is clean.
• The boot snippet and option defaults were checked against src/db.ts, src/migrations.ts, src/mount.ts and src/workflow-mount.ts.
• No references to ARCHITECTURE.md or the root SECURITY.md remain.

Closes CL-9092
Closes CL-9096
Closes CL-9097
Closes CL-9101
Closes CL-9108
Closes CL-9111
Closes CL-9113
Closes CL-9129

[TheGreatAxios]

Reviewed the whole branch against the code. The boot snippet matches createArtifactDb ({ db, close }) and runArtifactMigrations(db, options?). The option rows and their defaults match src/mount.ts and src/workflow-mount.ts, and the /api/workflow-artifacts path matches WORKFLOW_ARTIFACTS_BASE_PATH. Apart from the renamed Migration runner heading and the dropped options table, which the README tables now replace, the internals text moved into CONTRIBUTING.md unchanged. No stale ARCHITECTURE.md references remain. Each commit's message matches its diff. No blocking findings.