[FEATURE] document the manual branch workflow in README.md — this repository cannot use the recipes it makes possible

[oberstet]

wamp-ai is one of two repositories in the estate that cannot be brought fully
under the workflow it distributes, and the part it is missing has never been
written down.

The state, measured

wamp-ai   recipes:  no  — `just where` → "Justfile does not contain recipe `where`"
          hooks:    the files are here, but `setup-repo` cannot enable them here
          audit:    the template is here, but `generate-audit-file` cannot use it here

Every recipe in this justfile starts with cd .. — they are written to run
from .ai/ inside a consumer, and inside this repository they act on the parent
workspace directory instead. So the manual procedure is more manual than "no
just where": the audit file and the hook configuration are also by hand. That
is filed separately; this issue is about writing down what somebody must
actually type.

It cannot take .ai as a submodule — that is itself. It could take .cicd, but
wamp-proto/wamp-cicd#20 is taking .ai in the other direction, and both at
once mutually recurses on every --recursive clone. One direction only, and
this repository is the one that stays manual. The reasoning is on #20.

That is the right trade — this repository's gap is clerical while wamp-cicd's
was a policy gap — but "clerical" is exactly where every workflow failure in
this estate has landed. wamp-cicd/workflow.just's own header says so:

One day of work across two repositories cost ~30 mechanical git commands and
two hand-written audit files, none of which involved a decision — and every
single failure that day landed in that clerical layer, not in the thinking.

So the manual procedure needs to be written down, in this repository, where
somebody standing in it will find it.

Nothing documents it today

Checked across wamp-cicd's README.md, SCM-EXCHANGE-MODEL.md,
MERGE-AND-SIGNING-POLICY.md and SLSA.md, and this repository's README.md
and OVERVIEW.md: no mention of the no-.cicd case. wamp-cicd#46 covers how
a consumer is onboarded; #20 covers wamp-cicd's own gap. Neither covers
this.

Proposed: a ## Contributing section in README.md

Written as the commands, not as prose about the commands, because the reader is
mid-task. The substance, all of which is currently folklore:

Cutting a branch. No just new-branch, so by hand — and in this order,
because the reverse order is what cost typedefint-www#13 a force-push:

git checkout -b fix_<N> main

git config gpg.format x509           # BEFORE the commit, not after
git config gpg.x509.program gitsign
git config commit.gpgsign true
git config core.hooksPath .githooks  # note: .githooks, not .ai/.githooks
                                     # and NOT `just setup-repo`, which would
                                     # configure the parent directory instead

# NOT `just generate-audit-file` - it writes outside this repository.
mkdir -p .audit && cp audit/templates/audit-file.md.j2 .audit/oberstet_fix_<N>.md
$EDITOR .audit/oberstet_fix_<N>.md   # fill in submitter, date, issue, branch

git add .audit && git commit -S -m "start new dev branch; add audit file"

git cat-file commit HEAD | grep -c gpgsig    # must print 1

Never verify a signature with %G?. It prints N both for "unsigned" and
for "signed but this clone cannot verify", which is how an unsigned audit commit
got through once already. git cat-file is the check.

Publishing. No just publish, so the rule it encodes has to be applied by
hand: push to the fork and to the exchange, never the dev branch to the
authority. Under the current remotes that is origin and jotunheimr, not
upstream.

Landing. No just land. The merge is made locally with -S and pushed;
never the forge's merge button, because that makes GitHub's web-flow key the
signer of this history — wamp-cicd/MERGE-AND-SIGNING-POLICY.md is the
authority and should be linked rather than restated.

And say why it is manual, in one sentence with a link to #20. A procedure
that reads as an oversight invites someone to "fix" it by adding .cicd, which
is the one change that breaks recursive clones of both repositories.

Related, and worth reading together

• #18 — that cutting a dev branch and committing the audit file is a
  human-only act. This section is where that becomes an instruction.
• #15 — generate-audit-file infers the submitter from the origin owner,
  which is now the fork. Anyone following this section hits that.
• #16 — the commit-msg false positives. Anyone documenting a red phase hits
  that.
• wamp-cicd#46 — the consumer onboarding procedure. This is its sibling and
  the two should cross-reference.

Acceptance

• README.md has a ## Contributing section covering: cut, sign, verify,
  publish, land — as commands.
• The signing configuration appears before the audit commit in the ordering,
  and the %G? trap is named.
• It says which remotes a dev branch may be pushed to, and which it may not.
• It states why this repository is manual and links #20, so the absence reads
  as a decision rather than as a gap.
• Someone who has never seen this estate can cut, sign and land a branch here
  from that section alone, without reading workflow.just.

Note: This work was completed with AI assistance (Claude Code).