docs(release): make first-publication instructions and audit evidence accurate #110

Problem

The publish audit of 485f0445a93c1ec06e8142a2d602c33030d753d7 passed compilation, tests, rustdoc, package verification, and cargo publish --dry-run --locked, but two documentation issues remain:

• The README shipped inside the crate says “v0.3.0 is not yet published.” That text becomes false in the published 0.3.0 artifact.
• The release checklist presents old measurements as the final artifact and summarizes dependency licenses inaccurately. The audited archive contains 41 files, 105,118 compressed bytes (102.7 KiB), and Cargo VCS metadata for the audited SHA. Current registry metadata includes Zlib for foldhash, Apache-2.0 for safetensors, and an additional Unicode-3.0 requirement for unicode-ident, among other SPDX expressions missing from the summary.

Acceptance criteria

• Installation instructions remain accurate before and after the first upload, retain usable registry/feature examples, and provide a concrete immutable Git pin for development snapshots.
• The release checklist separates reusable package policy from dated audit evidence. Counts, sizes, hashes, license expressions, test results, and model-smoke evidence identify their actual source revision and do not claim qualification of an unpublished future commit.
• Document the exact lockfile dependency license expressions rather than grouping different licenses under MIT/Apache.
• Verify the changed README in the generated crate, inspect the package allowlist and VCS identity, and run package/publish dry-run checks.
• Keep publication, registry authority, tag/release creation, and the maintainer's credential verification under the existing release gate.

Relationships

Parent / release gate: #89. This fix blocks the documentation portion of #89; it does not close the publication issue.