fix: pre-landing review fixes for verify (test assertions, ekeys discard, double-report, docs)

Pre-landing review (0 critical, all informational) auto-fixes:
- Tighten external-corrupt test to assert the decrypt-fail message, not any
  external finding (was *"external"*, now *"does not decrypt"*).
- Pin the verified-count in the nested+external happy-path test so a silent
  under-count (exit 0 while skipping a blob) is caught.
- Account for an unsafe dotenv entry in `expected` so a matching stray blob
  isn't double-reported as both unsafe and orphan.
- Discard the unused external `keys` read field (read -r etype epath _).
- Document the optional [project] positional in the README verify row.

Deferred to EGB-701 (stage-2 dedup): the external blob-path literal and the
find-walk overlap with cmd_rekey/cmd_list. Full suite 210/210.

test/manifest.bats

@@ -754,6 +754,9 @@ m_nojq_path() {
   "$SECRETS_BIN" push >/dev/null 2>&1
   run "$SECRETS_BIN" verify
   [ "$status" -eq 0 ]
+  # Pin the count so a silent under-count (e.g. skipping the nested or external
+  # blob while still exiting 0) is caught: 3 dotenv + 1 external = 4.
+  [[ "$output" == *"4 blob(s) verified"* ]] || false
 }
 
 @test "verify: declared-but-missing blob is a finding (exit 1)" {
@@ -870,7 +873,8 @@ m_nojq_path() {
   printf 'garbage' > "$SECRETS_DIR/verifyextcorrupt/external/"*.age
   run "$SECRETS_BIN" verify
   [ "$status" -eq 1 ]
-  [[ "$output" == *"external"* ]] || false
+  # Pin the decrypt-fail branch specifically, not just any external finding.
+  [[ "$output" == *"does not decrypt"* ]] || false
 }
 
 @test "verify: an unsafe dotenv path in the manifest is a finding (exit 1)" {