docs: clarify the ratchet trust model

[coyaSONG]

What changed

• add npm download and GitHub star discovery badges
• give the existing architecture diagram a clear heading
• explain worktree isolation and separately persisted run, decision, lock, and frontier state
• connect the project to the broader AI tooling portfolio

Why

The README described the loop but left an important reliability question implicit: how an unverified candidate is prevented from becoming the baseline after a crash. The new paragraph answers that directly.

Validation

• npm audit --audit-level=high — 0 vulnerabilities
• npm run typecheck
• npm test — 44 files, 383 tests passed
• npm run build
• git diff --check