stage-7: demo polish — mesh-aware demo command, current README, run-sheet

psyc demo now closes with cockpit links pointing at the Worker Mesh and
reports whether the live model server is up. README rewritten to current
state — Worker Mesh, inference server, model-in-operation, the three
services, accurate code layout. Adds docs/demo.md, a one-page run-sheet.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/demo.md

@@ -0,0 +1,65 @@
+# psyc — demo run-sheet
+
+A ~5-minute walk-through of the platform; ~10 min including setup.
+
+## 0. Setup (once)
+
+```bash
+python3 -m virtualenv .venv
+.venv/bin/pip install -e .
+.venv/bin/psyc init
+```
+
+## 1. Start the services
+
+Separate terminals — the third is optional and needs an NVIDIA GPU:
+
+```bash
+# terminal 1 — operator cockpit
+.venv/bin/psyc serve --port 8767
+
+# terminal 2 — stand-in CERT / abuse-API receiver
+.venv/bin/psyc mock-cert --port 8770
+
+# terminal 3 — live model behind the Classifier bot (optional)
+docker run --gpus all --rm -p 8771:8771 --entrypoint python \
+    -v $(pwd)/data:/data -v $(pwd)/scripts:/scripts \
+    psyc-trainer /scripts/serve_model.py --adapter /data/adapters/psyc-v4/final
+```
+
+## 2. Run the pipeline
+
+```bash
+.venv/bin/psyc fetch-all     # ingest URLhaus + CISA KEV + Feodo Tracker
+.venv/bin/psyc demo          # one case end-to-end; prints the cockpit links
+```
+
+## 3. The walk-through
+
+1. **Case Queue** — http://127.0.0.1:8767/cases
+   30+ cases across three feeds, with severity + TLP badges. *"Three sources,
+   one normalized case object."*
+
+2. **Worker Mesh** — open the journey link `psyc demo` printed. This is the
+   centerpiece: seven robot agents, a case token flowing through, each bot
+   waking to perform its action and speak its real answer. Hit **▶ replay**.
+   - **Classifier bot** carries a live verdict from the fine-tuned psyc-v4
+     model — green when the model agrees with the rule, amber when it differs.
+   - **Sealer** — evidence encrypted to authority public keys (PyNaCl sealed box).
+   - **Router** — destinations cleared vs. policy-blocked (TLP ceiling, country).
+
+3. **Ledger** — http://127.0.0.1:8767/ledger
+   Every submission and every blocked route, immutably recorded.
+
+4. **Trainline** — http://127.0.0.1:8767/train
+   The four task datasets and the trained adapters with their loss curves.
+
+## Talking points
+
+- **Defensive only** — psyc never amplifies stolen data or contacts criminal
+  actors; routing is gated by TLP, jurisdiction, and incident type.
+- **Rules + model** — deterministic work is rule-based; the fine-tuned model
+  handles judgment. One bot is genuinely a live model, not animation over rules.
+- **Honest about limits** — psyc-v4 evals 7/8 on severity; the one miss is a
+  documented data-scarcity case (one online-botnet example), not a bug, and was
+  not gamed away.