docs: refresh README for the ephemeral-UI reframe + cut v0.4.0

[adnaan]

What & why

The narrative reframe landed in M0, but the README had gone stale on the concrete machinery that M1–M5 actually shipped. This brings it current and stamps the CHANGELOG for the v0.4.0 release (the whole [Unreleased] block is the reframe, all merged after v0.3.9).

README changes

• Governed-generation model — rewrote "AI-Assisted Development" → "Generating apps under policy": the /tinkerdown skill's approved-surface workflow (the generation: block), enforced twice (validate at generation + runtime approved-surface enforcement), on-brand styling.tokens + style_guide, /tinkerdown:save + the gallery, and the pii-access-approval console as the worked example — the app reads through read-only sources; every write goes through a governed, audited action.
  • Deliberately drops the plan's aspirational consent-record / --consent gate — verified no such flag shipped.
• Flagship row "Governed approval console" in What You Can Build.
• Source count 9 → 10 + the missing GraphQL row (real source, has examples/lvt-source-graphql-test) — reconciles the table & Key Features with the prose that already listed GraphQL.
• Tier-4 WASM now notes writable sources (export write) + serve/cli parity (M5).
• Version banner v0.2.x → v0.4.x.
• Two broken ROADMAP.md links fixed (the file moved to docs/archive/): dropped the Planning link; Contributing now points at the open issues.

CHANGELOG

• Stamped the reframe [Unreleased] block as [v0.4.0] - 2026-07-24, opened a fresh empty [Unreleased].
• The v0.3.0–v0.3.9 releases were tagged but never CHANGELOG'd; that pre-existing gap is left as-is, not backfilled.

Release plan (after merge)

release.sh only tags — so once this merges, the tag is cut from main:

1. In the primary worktree: git checkout main && git pull --ff-only.
2. Verify HEAD == origin/main and git log -1 shows this commit.
3. ./release.sh 0.4.0 → pushes v0.4.0 → triggers cli-release.yml.

Verification

• Non-E2E full suite green: 17 pkgs ok, 0 fail; go build ./... clean.
• Docker-Chrome E2E not run — the diff is two markdown files with no runtime surface (nothing served/parsed/loaded by any app), and no test pins the repo-root README content.

🤖 Generated with Claude Code

https://claude.ai/code/session_018M9pJSPmG6i1D8s6rpEV4h

[claude]

Review

This is a docs-only change (README + CHANGELOG), and it's well-executed. I checked out main and cross-referenced the factual claims against the actual repo state:

Verified accurate:

• examples/lvt-source-graphql-test, examples/pii-access-approval, and examples/gallery all exist and back the new prose/table rows.
• The data-sources table now lists exactly 10 rows (sqlite, json, csv, rest, graphql, pg, exec, markdown, wasm, computed), matching the "10 data sources" bullet in Key Features — good catch on the stale count/missing GraphQL row.
• docs/archive/ROADMAP.md is where the file actually lives now, so dropping the dead ROADMAP.md links and pointing Contributing at the issues tracker is correct; no other README/docs links still point at the old path.
• The security claim in the new "Governed generation" section — "the row cap comes from the request row, not the client" — checks out against examples/pii-access-approval/tinkerdown.yaml:93 (LIMIT COALESCE((SELECT row_cap FROM access_requests WHERE id = :id ...), 0)), and is exercised by a dedicated regression test (pii_access_approval_actions_test.go) that asserts the LIMIT doesn't fall back to unbounded on a NULL row_cap. Good to see a doc claim about a security property actually backed by a test.
• No duplicate ## [v0.4.0] heading in CHANGELOG.md, and the [Unreleased] → [v0.4.0] stamping follows Keep a Changelog conventions correctly (fresh empty [Unreleased] left on top).

Minor/non-blocking notes:

• The new "Governed approval console" row is inserted at the top of the What You Can Build table, ahead of Dashboard/Literate/Triage/Admin, breaking whatever loose ordering existed before (looked roughly by shipped-order). Not a real issue, just flagging it was a deliberate choice (flagship placement) rather than following existing table order.
• The version banner bump (v0.2.x → v0.4.x) and the CHANGELOG v0.4.0 stamp both land in this PR before the tag is actually cut per the described release plan. That's a reasonable sequencing given release.sh only tags from main, but it does mean if the release step is skipped or delayed, the README/CHANGELOG will claim a version that hasn't been tagged yet. Worth just following through on the release plan promptly after merge (as the PR description already commits to doing).
• Per CLAUDE.md, lvt-* attributes should be checked against the livetemplate/client repo before reimplementation — not applicable here since this PR only references existing lvt-* vocabulary in prose and doesn't add/change any attribute behavior.

Test coverage / risk: Appropriately none needed — this is prose and a changelog entry with no runtime surface, consistent with the PR's own verification note (17 pkgs green, E2E skipped with a clear rationale).

No blocking issues found. Nice work reconciling the README against what M1–M5 actually shipped rather than the original plan (e.g. correctly dropping the aspirational --consent flag that was never built).