docs: make local evidence the first-run path

[hippoley]

Now that counterproof check is merged and clean-install tested, the README should let a new user get value before asking them to write GitHub workflow configuration.

This change moves onboarding to:

install
→ counterproof check
→ inspect scoped evidence
→ optional doctor
→ optional counterproof init
→ strict CI only after observed behavior

The example keeps the same evidence boundary as the CLI: WITNESSED / SUBMITTED JUDGE / CLEAN / product oracle UNVERIFIED, and explicitly avoids a merge-readiness claim.