docs(safegres): rebrand as a two-axis security + performance auditor

[pyramation]

Summary

Every user-facing surface still called safegres a "pure-PostgreSQL Row-Level Security auditor" — the npm description, both CLI usage headers, and the README's first line. That is now roughly half the product: 11 of 29 rules are performance, they have their own score, their own baseline ratchet, and their own planner-proof mode, and constructive-db gates on the perf ratchet more meaningfully than on the security grade.

This changes the positioning to one auditor, two independently-scored dimensions and restructures the README around how the analysis actually works (catalog → policy ASTs → effective-access lattice) rather than around RLS.

README: 519 → ~370 lines, reordered so a reader hits the product before the reference material:

hero + tagline · 30-second install · sample two-score output
How it works        ← new: the three representations (catalog / AST / lattice)
What it checks      ← both rule tables side by side, direction as a column
Exposure surface · CI in one job · The ratchet · Configuration · Scoring · Commands
Going further       ← links to docs/

• 30-second install is now the second thing on the page: npm i -D safegres → doctor → audit --perf. No config file, no flags.
• CI in one job replaces the old pgpm-only ephemeral-database story with a framework-agnostic recipe (service container + your migration command, rails db:schema:load / manage.py migrate / prisma migrate deploy / …), and collapses the old example that ran the audit twice under the heading "Audit RLS".
• Adds an explicit Requirements block covering the things the README previously left to doctor: a non-superuser/non-BYPASSRLS role gets a silently partial audit; --explain needs PG16+; --stats is meaningless on a fresh CI database; security has no baseline (only perf and the call graph do).
• X7's rationale is de-Constructive-ised — it was stated as a general Postgres truth but rests on graphile-search exposing a filter for every tsvector column; now framed as "wherever anything searches the column", with the codegen case as the example.

The deep-dive prose is preserved verbatim, moved into packages/safegres/docs/: rules.md (lattice truth table, access-path signals behind X1, X7/X8/X9 arguments, extension objects, declared public reads), reporting.md (SARIF, --compare, snapshots), advanced.md (--stats, --explain, library use, pgpm), call-graph.md. README links to them by absolute URL, since docs/ is not copied into the published dist/.

Metadata and CLI:

-"description": "Pure-Postgres Row-Level Security auditor: … plus an optional index-hygiene performance score."
+"description": "Postgres security and performance auditor: RLS, grants and effective-access analysis plus
+                index and policy-cost checks, scored on two independent axes. One connection, no framework."
-safegres — pure-PostgreSQL RLS auditor          (src/cli/commands.ts, src/cli/audit.ts)
+safegres — Postgres security and performance auditor

Keywords drop constructive (an org term, not a search term) and add the ones the category is actually searched by: linter, static-analysis, query-performance, explain, grants, sarif, ci, devsecops, dba.

No behavior change — the only source edits are the two usage strings. Sample output in the README was checked against renderPretty/scoreLines so the shown format (score: … — model: density, top deductions, by rule … (+payoff), unscored … zero-weight, exposure: N schema(s) via config) matches what the tool prints.

Link to Devin session: https://app.devin.ai/sessions/b7874ecee0c7471ea271e6e7193869dc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring