v1.14.0

• --format suricata — the provider KB and residency policy compiled into a Suricata TLS-SNI alert ruleset for network-level detection of disallowed AI egress: one rule per KB endpoint host whose per-host jurisdiction falls outside the policy's expanded allow-list (uk→gb, GBA honoured); region-selectable clouds always alert, marked region-dependent; without a policy every known AI endpoint alerts (inventory visibility). Deterministic sids from 1900000, provider id and jurisdiction in msg and metadata, alert posture with a documented drop conversion, non-gating export (exit 0). Derived from the KB and policy — not scan findings — so runtime egress the static scan can't see (env-configured base URLs, agent tool calls, providers the codebase doesn't use yet) still trips an alert at the network boundary. Generated rulesets load 110/110 clean in Suricata 8.0.6.
• Docs — README restructured around a getting-started path: install → inventory scan → init → gated scan with real output up front; formats table; MCP and agent integrations merged into one section.