docs: cover signing, discovery, and admin commands in the surface-split section

Expand the manual/agent split so every command bucket lands on one side:

- Manual side: signing (`sign-message`, `sign-typed-data`), agent-token + policy admin (`list-tokens`, `use-token`, `revoke-token`, `list-policies`, `show-policy`, `delete-policy`), and the existing wallet ops
- Agent side: read-only listings (`positions`, `history`, `pnl`, `swap tokens`, `wallet list`, `wallet fund`, `watch list`) alongside analytics + trading
- Setup-gesture paragraph: `init`, `setup skills`, `setup mcp`, `config`, `watch` add/remove

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: graysonhyc

README.md

@@ -59,9 +59,10 @@ Skills live in [`zeriontech/zerion-agent`](https://github.com/zeriontech/zerion-
 
 Zerion CLI splits into two surfaces, by design.
 
-- **Wallet management is manual.** `wallet create`, `import`, `backup`, and `delete` all prompt for a passphrase. `wallet sync` emits a QR code you scan with the Zerion app. These commands assume a human at the keyboard — no key material moves without an explicit gesture.
-- **Agent token setup is manual.** `agent create-token` mints a scoped trading token bound to a specific wallet, and `agent create-policy` attaches the rules it has to obey — allowed chains, expiry, transfer/approval gates, contract allowlists. You do this step yourself so the automation downstream inherits a key it cannot widen.
-- **Analysis and trading are for agents.** `analyze`, `portfolio`, `swap`, `bridge`, and `send` emit JSON to stdout, structured errors to stderr, and skip confirmation dialogs. Once an agent token is configured, trades fire immediately.
+- **Wallet, signing, and agent token setup are manual.** `wallet create`, `import`, `backup`, and `delete` all prompt for a passphrase, as do `sign-message` and `sign-typed-data`. `wallet sync` emits a QR code you scan with the Zerion app. `agent create-token` mints a scoped trading credential bound to a specific wallet, and `agent create-policy` attaches the rules it has to obey — allowed chains, expiry, transfer/approval gates, contract allowlists. The sibling admin commands (`agent list-tokens`, `use-token`, `revoke-token`, `list-policies`, `show-policy`, `delete-policy`) are also gestures you make yourself. No key material moves and no spending credential widens without you in the loop.
+- **Analysis, trading, and discovery are for agents.** `analyze`, `portfolio`, `positions`, `history`, `pnl`, `swap`, `bridge`, `send`, `swap tokens`, `search`, `chains`, `wallet list`, `wallet fund`, and `watch list` emit JSON to stdout, structured errors to stderr, and skip confirmation dialogs. Once an agent token is configured, trades fire immediately.
+
+Setup gestures (`init`, `setup skills`, `setup mcp`, `config set/unset/list`, `watch` add/remove) are one-time configuration steps you run yourself before automation takes over.
 
 The split is the point. You stage by hand once — create or import a wallet, set a passphrase, mint an agent token, attach a policy — then hand the agent token to an automation that can only do what the policy allows. Treat agent tokens like API keys with spending power; use [agent policies](#agent-policies) to scope them down to specific chains, addresses, or expiry windows.