feat: add PolicyChecks badges and evidence model

[hesreallyhim]

Summary

• add PolicyChecks README badges and normalize badge messages to enforced/not enforced/unknown
• add proof-level evidence metadata for source, scope, and GitHub enforcement details
• document the read-only policy surface and the no-write-permissions boundary in ADRs

Validation

• npm run check

Notes

• Repository Metadata: Read is treated as the implicit GitHub App baseline, not as an additional installer-facing permission ask.
• Ruleset-backed claims are framed as active applicable rule checks unless bypass visibility or continuity evidence is explicitly available.