docs(demo): add end-to-end demo with recorded GIF

Squashes the demo-build arc: initial GIF + scripts, refactor to drive
recording through real cli.py, theme/timing tweaks, and the switch to
prompt-driven probes.

scripts/demo.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Human-runnable demo wrapper. Stages the demo manifest and dummy
+# identity (see scripts/demo-setup.sh), launches `./cli.py start demo`
+# interactively, then restores prior state. The recorded GIF
+# (docs/demo.gif) goes through the same flow via docs/demo.tape.
+#
+# Once attached to claude inside the bottle, use the `!` prefix to run
+# bash directly — e.g.
+#   ! curl --proxy "$HTTPS_PROXY" -sw 'status=%{http_code}\n' \
+#       -o /dev/null http://example.com/
+# returns 403 because example.com is not on the bottle's allowlist.
+
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+if [ -z "${CLAUDE_BOTTLE_OAUTH_TOKEN:-}" ]; then
+  cat <<'EOF' >&2
+demo: CLAUDE_BOTTLE_OAUTH_TOKEN is unset. The bottle launches claude,
+which needs the token to authenticate. Set it in your shell env (e.g.
+~/.zshrc) — see README §Auth — then re-run.
+EOF
+  exit 1
+fi
+
+bash scripts/demo-setup.sh
+trap 'bash scripts/demo-teardown.sh' EXIT
+
+./cli.py start demo