docs: explain the install behavior diff

[kiranmagic7]

What changed

The README now explains BehaviorLock in plain language as a before and after observation of npm install. It walks through the five steps, keeps the experimental warning above the fold, and shows the exact three row diff produced by the inert fixtures.

A new docs/EXAMPLE_DIFF.md page contains the reproducible commands, the full unedited report, the expected compare exit code, and a short explanation of what the result does and does not mean.

Why

The repository explained the architecture before showing a real result. A first time visitor can now understand the tool, inspect its output, and see the evidence rather than verdicts boundary without reading the full technical reference.

Impact

Documentation only. This does not change the CLI, schemas, capture path, sandbox, policy levels, or release state. It does not add promotion or distribution work.

Verification

1. Rebuilt the current CLI and reproduced both fixture profiles.
2. Confirmed the Markdown output byte content shown in the example, including the AF_INET: target.
3. Confirmed compare exits with code 1, which is the expected review signal.
4. Ran make check successfully.
5. Ran make build successfully.
6. Ran git diff --check successfully.

AI assistance

AI tools assisted with drafting, reproduction, and verification. The submitted text and commands were reviewed against the current repository output.

[kiranmagic7]

Supersession note: the current v3-compatible example and README path are integrated in draft PR #31. Do not apply this older standalone documentation patch into the current stack without reconciliation.

[kiranmagic7]

Superseded by the consolidated PR #31. The useful README and exact example work is retained there. Closing this standalone draft to keep one active upgrade review branch. No merge, release, or launch occurred.