docs: Restructure README for users; move contributor material to CONTRIBUTING

[hexember]

Summary

Make README.md the single user-facing landing doc (why, install, use, privacy, limits, uninstall), with every claim checked against the current code. Move contributor-only material into CONTRIBUTING.md without duplicating anything and without losing any fact. Docs only: no Swift, install.sh, Makefile or workflow changes.

What moved where

• README keeps: title block, badges, pitch, Why this exists table, Install, Build from source (new, short), Using it, How a URL is routed, Privacy (new), Known limitations (moved up), Uninstall (promoted to ##, default-browser reset now first), Contributing, Changelog, License.
• README → CONTRIBUTING.md: Development (make block, bundle and make run gotchas, logging snippet), Architecture tree, Repository layout (now with assets/ and .github/workflows/), project history and the Project.md deviations, Testing, Design constraints, Releasing, and a new Testing a release locally section (ACTIVEBROWSER_ZIP / _SUMS / _VERSION).
• SECURITY.md What the app can see → one-line pointer to README.md#privacy. The privacy facts now live in one place.
• assets/README.md: stale Not yet wired into the bundle replaced by How the bundle uses these.
• CHANGELOG.md: one [Unreleased] → Changed entry.

Stale facts corrected (checked against the code)

• Menu bar icon is the bundled ActiveBrowser mark, not a globe. The globe is only a fallback for unbundled builds.
• Menu mock-up: the row is either Set as Default Browser or a disabled ✓ Default Browser. Submenus use ✓ (no ☑/●○). ⌘Q on Quit. Recent: is capped at 3 names and reads none yet when empty.
• Unticking the fallback moves it to the first remaining ticked browser in menu order (A→Z).
• "Unticked browsers never receive links" was not strictly true. The last-resort step can still pick one when no browser in the focus history is installed and the fallback is gone.
• Routing step 4 is spelled out: the first installed https handler by name. Every candidate must exist on disk, and the app's own bundle id is dropped from every step.
• Added: first-launch defaults, Launch at Login behaviour (/Applications only, opt-out remembered, mixed state opens System Settings), focus history is in memory only, and the .html/.xhtml low-priority viewer claim.
• Project.md deviations: "three places" became "several places, notably these three".
• assets/README.md: the icons are wired into the bundle (since task 12).

Spec checklist

• README.md: rewritten to the exact 12-heading outline, with fact corrections F1–F13 applied and contributor sections removed.
• CONTRIBUTING.md: README's contributor material merged in with no duplicated text, following the target outline (build → gotchas → architecture → layout → history → testing → constraints → PRs → releasing → testing a release locally).
• SECURITY.md: ## What the app can see kept; body replaced with a pointer to README.md#privacy after confirming every old fact is in README Privacy.
• CHANGELOG.md: [Unreleased] → ### Changed entry added.
• assets/README.md: ## Not yet wired into the bundle replaced by ## How the bundle uses these (F16), with "run from assets/" note above the regeneration commands.

Self-verification

#	Action	Expected	Actual	Result
1	Heading outlines of README / CONTRIBUTING vs main	Match the Spec outlines exactly; only the planned additions/removals	outlines match Spec exactly; diff shows only the planned changes	pass
2	Moved-fact presence greps (23 strings)	CONTRIBUTING ≥ 1 each; README 0 except the idle memory figure	CONTRIBUTING ≥1 for all 23; README 0 for all except the idle figure, written as "about 12 MB"	pass
3	Zero-duplication greps (make run row, /tmp/ab.log, two ActiveBrowser rows, log show, is \nil` outside a bundle, git tag, No polling`)	README 0, CONTRIBUTING ≥ 1	README 0 / CONTRIBUTING ≥1 for all 7	pass
4	Privacy single-sourced; no CDN host named	README ≥ 1 / SECURITY 0 for "network requests"; key + domain in README; SECURITY pointer; CDN count 0	README 1 / SECURITY 0; key 1; domain 2; pointer at SECURITY:35; CDN 0	pass
5	Menu-label fact-check; globe, ☑●○, Not yet wired, three places	Labels ≥ 1; others 0; any "three places" says "notably"	all labels ≥1; globe 0; glyphs 0; Not yet wired 0; no "three places" line	pass
6	Relative link and anchor check over the 5 files	broken: 0; #install and #why-this-exists ≥ 1	broken: 0, exit 0; #install 2; #why-this-exists 1	pass
7	CHANGELOG [Unreleased] entry	1; only added lines	1; no removed lines	pass
8	Changed files	Only the 5 .md files + task file	only the 5 .md files + task file	pass
9	swift build	No warnings/errors; Build complete!	only the 2 CommandLineTools ld search-path lines (known environment noise); Build complete!	pass
10	Dropped-fact audit of git diff main -- README.md	No unlisted fact lost	reviewer's line-by-line audit + steps 2–4 greps: no unlisted fact lost	pass

Testing notes

Preconditions

• No build needed. This is a docs-only change and nothing is installed.
• System state: unchanged.

#	Action	Expected
11	On this PR, open Files changed → README.md → Display the rendered blob. Read top to bottom, click the platform badge and the Why this exists / Build from source / Install links.	The page reads as a user landing doc. The badge jumps to Install. All in-page links land on the right heading. The menu mock-up matches what you see when you click the menu bar icon (with the ✓ Default Browser row if ActiveBrowser is your default). No developer-only sections remain.
12	Same for CONTRIBUTING.md and SECURITY.md (rendered).	CONTRIBUTING reads in order: build → gotchas → architecture → layout → history → testing → constraints → PRs → releasing. Nothing is said twice. SECURITY's What the app can see link opens README Privacy.

Reset after testing

• None (docs only).

🤖 Generated with Claude Code