Document continuous verification

[priithunt]

What changed

• document the bounded private CI path and its safety boundary
• explain current inventory and synthetic Apple Silicon secondary coverage
• connect architecture readiness to the existing machine-candidate lifecycle

Why

P1 adds independent source verification and prepares the secondary role for a
future ARM replacement while keeping the active Intel binding unchanged. The
public showcase should explain that design without exposing private inventory
or service configuration.

Validation

• scripts/verify-showcase.sh
• exact comparison of all changed public files with the curated private source