feat: jq gating, platform-aware install hints, stage-1 docs (EGB-677 stage 1)
- jq required only when .secrets.json exists or is being written;
manifest-less projects run jq-free (features skipped with a notice) —
clone-and-run for v1 users survives (no-jq fixture excludes /usr/bin,
macOS ships jq there now)
- check_cmd: platform-aware hints (brew/apt-get/dnf/generic) instead of
hardcoded brew — correct guidance on Linux/CI
- cmd_help: add command, push flags, manifest section with example
- README: manifest section, external files rewritten around
.secrets.json (legacy .secrets-files documented as absorbed),
troubleshooting entries, command table, test instructions
- CLAUDE.md: manifest architecture notes, bash-3.2 '[[ ]] || false'
testing convention, project structure refresh
89e851278b