fix: pre-landing review fixes for verify (test assertions, ekeys discard, double-report, docs)

Pre-landing review (0 critical, all informational) auto-fixes:
- Tighten external-corrupt test to assert the decrypt-fail message, not any
  external finding (was *"external"*, now *"does not decrypt"*).
- Pin the verified-count in the nested+external happy-path test so a silent
  under-count (exit 0 while skipping a blob) is caught.
- Account for an unsafe dotenv entry in `expected` so a matching stray blob
  isn't double-reported as both unsafe and orphan.
- Discard the unused external `keys` read field (read -r etype epath _).
- Document the optional [project] positional in the README verify row.

Deferred to EGB-701 (stage-2 dedup): the external blob-path literal and the
find-walk overlap with cmd_rekey/cmd_list. Full suite 210/210.

secrets

@@ -1980,6 +1980,9 @@ _verify_project() {
     if ! _validate_dotenv_rel_path "$rel" 2>/dev/null; then
       echo "FINDING: unsafe dotenv path in $SECRETS_JSON_NAME: '$rel' (will be refused)." >&2
       findings=$((findings + 1))
+      # Still account for it so a matching stray blob isn't ALSO flagged as an
+      # orphan (one bad entry → one finding, not two).
+      expected="$expected$rel.age"$'\n'
       continue
     fi
     expected="$expected$rel.age"$'\n'
@@ -1997,8 +2000,9 @@ _verify_project() {
   done < <(jq -r '.dotenv // [] | .[]' "$manifest")
 
   # ── external entries: missing-blob + decrypt ──
-  local etype epath ekeys slug erel eblob
-  while IFS=$'\t' read -r etype epath ekeys; do
+  # verify only needs type + path to locate the blob; keys are irrelevant here.
+  local etype epath slug erel eblob
+  while IFS=$'\t' read -r etype epath _; do
     [ -n "$etype" ] || continue
     slug=$(_secrets_files_slug "$epath")
     erel="external/$slug.$etype.age"