docs(demo): add bad-good sample API and three-minute walkthrough

[back1ash]

Summary

Provide a reproducible local demonstration that starts blocked, explains evidence, applies a fix, and finishes passing.

Scope

• Add intentionally bad and corrected shopping-style OpenAPI examples.
• Cover generic context, parameter, response, confirmation, and security findings.
• Document exact commands, expected exit codes, and representative output.
• Explain what a pass does and does not guarantee.
• Keep the complete walkthrough under three minutes on a prepared host.

Acceptance criteria

• The bad example exits 1 with the expected High and Medium findings.
• The corrected example exits 0 with the same pinned artifacts.
• Commands work on every supported platform or have equivalent documented syntax.
• The demonstration requires no network, credentials, or private data.
• Documentation links each fix to the relevant rule specification.

Dependencies

• feat(rulepack): implement the five P0 agent contract rules #23
• feat(cli): implement the scan command and stable exit codes #25
• feat(cli): add console and stable JSON reporters #26

Priority gate and claiming

Keep status:blocked until every open priority:p0 issue is closed
and every explicit dependency above is closed. Only then replace it
with status:ready and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Hosted GitHub App demonstration or production API invocation.
• Automatic remediation or broad tutorial content.