feat(demo): longhand demo + pre-push audit polish (v0.9.2)

[Wynelson94]

Summary

Two changes, scoped for the v0.9.2 second-push:

1. longhand demo — new CLI command that runs a sandboxed walkthrough on a fake 3-session corpus, so new users can try Longhand without touching their real ~/.claude or ~/.longhand. Closes the onboarding gap identified in the 2026-05-17 audit.
2. Pre-push polish — .gitignore hygiene (defensive secrets block) and outreach/README.md traction refresh (175/wk vs 733 peak baseline, reframed sequencing for a release-paired distribution event).

What it looks like

$ longhand demo
──────────────── Longhand demo ────────────────
Sandbox at /tmp/longhand-demo-20260517-... — your real ~/.longhand and ~/.claude are NOT touched.

Seeding 3 fake Claude Code sessions into a temp store...
  → ingested 3 sessions, 36 events on project demo-shop

Workflow in the corpus:
  • 2 days ago: Stripe webhook handler + signature-verification bug fix
  • 1 day ago: Supabase auth migration from createClient → SSR createServerClient
  • today:    Quick 401 fix in /api/checkout caused by yesterday's auth migration

──────── Try 1: cross-session bug retrieval ────────
Question: "the stripe signature bug on demo-shop"

[recall narrative shows the fix from 2 days ago, files touched, diff, verified]

──────── Try 2: "where did I switch to SSR auth?" ────────
[recall narrative for the migration session + related sessions footer]

──────── Try 3: "pick up where I left off on demo-shop" ────────
[recall_project_status: last session outcome, known issues, recent work]

──────── Done ────────
Like what you saw? Point Longhand at your real Claude Code history:
  pip install longhand
  longhand setup

Pass --keep to leave the sandbox in place for further exploration:

LONGHAND_DIR=/tmp/longhand-demo-<ts>/store longhand sessions

Why

The 2026-05-17 runtime audit identified that new users had no safe way to preview Longhand on sample data before running longhand setup on their real ~/.claude. The demo command fills that gap with a 60-second walkthrough that exercises the cross-session recall, file history, and project-status surfaces without modifying anything on disk outside the sandbox.

This release is the fresh angle for the second distribution push (April launch decayed from 733 weekly installs to 175). Paired with the existing SafeSkill 93/100 + GLAMA A-tier badges as legitimacy signals.

Files

• longhand/demo/__init__.py, corpus.py, runner.py — new package
• longhand/cli/_commands.py — @app.command() def demo(...)
• tests/test_demo.py — 6 new tests (determinism, valid event shape, ingestion, recall, cleanup)
• README.md — "Want to kick the tires first?" quickstart paragraph
• CHANGELOG.md — v0.9.2 entry
• .gitignore — defensive Secrets block (.env*, *.key, *.pem, credentials.json, *.token)
• outreach/README.md — traction snapshot refresh + reframed sequencing

Test plan

• ruff check longhand tests → clean
• python3 -m pytest -x -q → 228 passing (was 222, +6 demo tests)
• python3 -m longhand demo → all 3 recall calls produce useful narratives, sandbox cleans up
• python3 -m longhand demo --keep → leaves sandbox; LONGHAND_DIR=<path> longhand sessions shows the 3 seeded sessions
• CI matrix (3.10–3.13) passes
• After merge: tag v0.9.2 → OIDC publish via GitHub Actions Trusted Publishing → smoke pip install --upgrade longhand && longhand demo

🤖 Generated with Claude Code