launch: dogfood demo — publish the maintainer's own attested report (HITL)

[gkanitz]

Context

Launch-readiness item (HITL). The fictional sample report is fine for docs
and goldens, but "here's mine" beats "here's what one could look like" as
the launch centerpiece — it demos authenticity, exercises the exact
self-run path we want strangers to take (#56), and gives the verify page a
real public artifact to prove itself on (#57).

Goal

The owner's own attested report — produced via the self-run path over the
owner's repos — published as the linked demo on the landing page and
README.

Owner steps (HITL — nothing publishes without explicit consent)

• Decide the coverage set: which of your own private/public repos you
  are comfortable having named in the coverage stamp (repo names
  are visible in the published report; that is the point, but it is
  your call which ones).
• Run the self-run per docs: self-run setup guide — attested reports from a personal repo, no org needed #56's guide (personal repo, fine-grained PAT,
  pinned canonical workflow) → report.html, report.pdf, card when
  available.
• Review the full output — every rendered section and the embedded
  JSON — for anything you don't want public.
• Post an explicit approval comment on this issue naming the artifact
  you approve for publication. This comment is the publication
  gate.
• Verify the published artifacts on the live verify page (feeds qa: end-to-end verify-flow validation on live domain (HITL) — closes out #37/#34 #57's
  checklist).

Agent prep (may proceed before owner steps)

• Landing page (docs/index.html): a "See a real report" slot linking
  the demo artifact, clearly labeled as the maintainer's own attested
  report; keep the fictional sample linked for contrast, labeled
  fictional.
• README: swap the primary example link to the real report once
  published; retain the sample-report link for docs/tests context.
• Hosting path for the artifact under docs/ (served by Pages) so no
  new infrastructure is added.

Acceptance criteria

Success: a real, Sigstore-attested report (+PDF) is publicly linked
from landing page and README; drag-and-drop on coderepute.dev/verify/
verifies it; the owner's approval comment exists on this issue and predates
the publishing merge; the fictional sample remains in place for goldens.

Failure — red flags: anything published without the approval comment;
a demo report that fails verification; coverage naming repos the owner did
not explicitly approve; the fictional sample deleted (goldens depend on
it).

Parallel-work contract

• Territory: docs/index.html, README, docs/ artifact path.
• Depends on: docs: self-run setup guide — attested reports from a personal repo, no org needed #56 (the guide being followed), qa: end-to-end verify-flow validation on live domain (HITL) — closes out #37/#34 #57 (live verify page
  working). Label needs-owner-review — must not merge without the owner's
  approval comment.