README standout features + TUI-first restructure (demo, doctor)

[21tmccauley]

Makes the README land harder on first read and adds two small showcase features. Builds on the merged CI, versioning, and KSI work.

README

• Reordered the "how to use it" narrative to TUI → AI agent → CLI (was manual-CLI-first). New flow: Supported services → Install → The TUI → Drive it with an AI agent → Using the CLI → How it runs (architecture) → layout/docs. The scattered usage bits (command surface, doctor, manifest building, upload) are consolidated under "Using the CLI".
• Badge row: CI, license, Python, version.
• "Drive it with an AI agent" section leaning on --json everywhere, the {ok, errors} manifest contract, and the shipped .claude/skills.

Features

• Zero-credential demo: a synthetic demo_hello fetcher (new demo category) + examples/demo.yaml, so paramify run examples/demo.yaml exercises the whole collect → envelope pipeline with no cloud account. Doubles as a CI smoke fixture.
• paramify doctor [manifest] (api.doctor + CLI): preflights Python version, the external CLIs each category needs (aws/jq, kubectl, checkov/git), and — with a manifest — whether its secret env vars are set; exits non-zero on gaps.

Deliberately parked

• The FedRAMP 20x coverage section (badge + family table) is not published — we're not yet confident enough in the KSI mapping. tools/gen_ksi_coverage.py is kept but parks gracefully when the README markers are absent, ready to resume later. paramify ksi still computes live numbers.
• Removed the "Why the design is strict" section; the pre-1.0 Status note was preserved (moved into "How it runs").

Tests

• tests/test_cli.py: EXPECTED_TOP adds ksi + doctor; two new doctor tests.
• Local: ruff + mypy clean; 209 tests pass; smoke describes all fetchers; demo runs end-to-end.

🤖 Generated with Claude Code