docs(readme): lead the v2.0 section with what it does for you, cut the rest

[killertcell428]

Summary

The v2.0 section explained how aigis profile build works before saying why anyone would run it, so an IT/platform reader skimming the README could not tell what they gained. This rewrites that section around the outcome, cuts three sub-sections that were too detailed for a README, and makes "Why Aigis?" answer why an input/output filter misses the three agent-specific attacks instead of just naming them.

Documentation only — no code changes. Both README.md and README.ja.md stay in sync.

Changes

• v2.0 section rewritten. Opens with the problem (two hand-written config files per team; Claude Code evaluates its own permission rules before the hook, and the two formats differ, so one is always stale), then the two commands, then four concrete outcomes. The two design-choice paragraphs (shell has no allowlist, git has three values) move into a <details> block — kept, off the main line.
• Numbers re-measured against aigis profile build profiles/marketing.json: 15-line role file → 191-line policy (30 rules) + 26 Claude Code permission rules, 10 not expressible.
• Corrected an inaccurate claim. profile build prints excluded rule IDs only; the why: / fix: lines come from aigis settings. The README said profile build printed a reason and a hand-written alternative for each.
• v1.2 section shrunk to a heading, one paragraph and the GIF, now that v2.0 is the headline feature.
• "Two layers" / "The audit gap" / "The key's location" collapsed into one section with a new #audit-key anchor; detail moved to links into docs/adoption/. The IT-question table's [details] link is repointed at the new anchor.
• "Why an independent OSS layer" removed. The acquisition list is still in the FAQ, which is where a reader asking that question looks. The trust-pack / adoption links below it are kept.
• "Why Aigis?" rewritten. Each of the three attacks now says why a perfect input/output filter does not see it — the MCP tool definition is read as an instruction, the planted memory fires in a later session with no attacker input present, the retrieved page was never typed by the user. The attack-surface table moves below the three scenarios.
• Qiita article table dropped from README.ja.md. The English README never had it, and it sat between the benchmarks link and Contributing.

Type of change

• Documentation update

Testing

• pytest tests/ -v passes locally — not run; no code changed
• Every internal link and anchor in both READMEs verified to resolve (including the new #audit-key and the repointed table link)
• Every quoted number reproduced by actually running the CLI (see below)

Checklist

• I have read CONTRIBUTING.md
• CHANGELOG.md updated under [Unreleased] — not applicable, README-only change

Screenshots / output

$ aigis profile build profiles/marketing.json
Profile: Marketing
  web       read          Can fetch web pages and search the web
  files     workspace     Can read and write inside the working directory
  shell     none          Cannot run shell commands
  git       none          Cannot use git
  packages  none          Cannot install dependencies
  mcp       approved      Can use MCP servers the administrator listed

  Wrote aigis-policy.yaml (30 rules)
  Wrote .claude/settings.json (26 permission rules)

  10 policy rule(s) could not be expressed as Claude Code
  permissions. The Aigis hook still enforces them:
    [dangerous_format] shell:exec  *mkfs*  -> deny
    ...

wc -l: profiles/marketing.json 15 · generated aigis-policy.yaml 191.

🤖 Generated with Claude Code