docs: refresh README, restore CHANGELOG Unreleased, tick ROADMAP

[dmartinochoa]

Summary

Documentation pass that consolidates everything from PRs #11–14 into a coherent story for v0.2.0. Stacked on #14, no code changes. lint / compile / tests / smoke all green.

What changed

README.md

• New "Features" section highlighting the surfaces that have landed: inline diagnostics, Findings panel, status bar, CodeLens, keyboard navigation, tunable signal.
• Configuration table gains `pipelineCheck.disabledProviders` and notes the machine-overridable scope on serverCommand/serverArgs.
• New "Commands and keybindings" reference table — Alt+F8 / Shift+Alt+F8 / Change Grouping / Refresh.
• New "Workspace trust" section documenting the limited-trust declaration.
• "Development" script list expanded to cover test, test:integration, smoke, lint.
• "Releasing" section gains the `vX.Y.Z-rc.N` pre-release convention, the `production` Environment gate, and the three-OS CI matrix description.
• Screenshot HTML comment updated to call out the four shots we want (inline / findings-panel / hover / status-bar). The block is commented out until the actual PNGs land.
• New "Security" pointer to SECURITY.md.

CHANGELOG.md

• Restored `## [Unreleased]` block at the top — was deliberately removed for the v0.1.1 release commit to satisfy the awk-based release-note extractor in publish.yml.
• Documented every in-flight item for v0.2.0 under Added / Changed / Fixed, each with an R-tag cross-reference to the roadmap.
• Added a callout at the top of the file warning that publish.yml's release-note extractor prints between the first and second `## [` headers — future release commits must fold or remove the Unreleased block.

ROADMAP.md

• "Status snapshot" table at the top mapping v0.1.0 / v0.1.1 / v0.2.0 state to closed-item counts.
• 19 of 29 R items ticked with PR cross-references (review-followups: code fixes, perf, docs links, status bar, CI matrix #11–review-followups-4: @vscode/test-electron integration tests (R17) #14).
• Outstanding maintainer action items reorganised — stale v0.1.0-era items removed; current blockers (CodeQL setup, PVR/Discussions toggles, manual H4 smoke, screenshots) called out explicitly with the rationale for each.

Test plan

• No code changes — `npm run lint`, `npm run compile`, `npm test` (90 tests pass), `npm run smoke` all clean.
• Description length CI gate: 141 of max 145 chars.
• Visual review of the README in the marketplace listing once shipped (the "Features" copy is the part marketplace browsers actually read).

Notes on release flow

When you cut v0.2.0, the release commit needs to:

1. Bump `package.json#version` from 0.1.1 → 0.2.0
2. Rename `## [Unreleased]` to `## [0.2.0] — `
3. Remove the `## [Unreleased]` block entirely (or move it below the `## [0.2.0]` section — either way the awk extractor must hit `## [0.2.0]` as the first header)

The CHANGELOG-fold check in publish.yml will refuse the tag otherwise.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: af63642e-4720-4005-8e2e-73234147ee88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs-polish

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dmartinochoa]

Rolled into #16 (v0.2.0 mega-PR). Every commit from this branch is in #16's history; closing to consolidate the merge.