docs: add end-to-end demo with recorded GIF

scripts/demo.sh + scripts/demo_harness.py drive a real bottle through
four probes (pipelock allow, host-allowlist block, DLP body-scan
block, git-gate gitleaks rejection). docs/demo.tape is the VHS source
that renders docs/demo.gif, embedded at the top of the README as a
working proof of the security model the prose describes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/demo.tape

@@ -0,0 +1,38 @@
+# VHS tape — produces docs/demo.gif from scripts/demo.sh.
+#
+# Usage:
+#   brew install vhs    # if you don't have it
+#   vhs docs/demo.tape  # ~60-90s; writes docs/demo.gif
+#
+# Re-record on changes:
+#   - new scenarios → tweak Height below
+#   - faster overall → shorten the Sleep after the trailing summary
+#
+# The harness paces itself with its own time.sleep() calls so each
+# scenario block has time to be read; VHS only needs to capture the
+# whole run end-to-end.
+
+Output docs/demo.gif
+
+Set Shell      "bash"
+Set FontSize   14
+Set Width      1100
+Set Height     780
+Set Padding    20
+Set Theme      "Catppuccin Mocha"
+Set TypingSpeed 60ms
+Set PlaybackSpeed 1.0
+
+Hide
+Type "clear"
+Enter
+Show
+
+Type "bash scripts/demo.sh"
+Sleep 500ms
+Enter
+
+# Warm-cache run takes ~14s; first-time runs that build images will be
+# longer, but the wrapper pre-warms quietly so the recording sees a
+# warm path. Pad a few seconds so the trailing PASS summary holds.
+Sleep 20s