app: ship a README.md in every support bundle and blackbox capture

An agent handed a bundle path had no way to know its layout without
grepping through random logs first — confirmed by watching a separate
session read bee-nvidia.log before anything else on a real bundle. Embeds
a single README.md (bee-embed, internal/app/assets/) explaining what bee
is and giving direct answers to the questions someone analyzing a bundle
is most likely to ask (did the tests pass, what hardware is this, is a
service healthy, RAID/GPU/NVLink state, etc), written at the bundle root
by both BuildSupportBundle (support-bundle archive root, sibling of
manifest.txt) and blackboxWorker.syncCycle (removable-media boot-folder
root, which otherwise has no manifest.txt-equivalent pointing anywhere).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/app/app_test.go

@@ -954,6 +954,66 @@ func TestBuildSupportBundleIncludesExportDirContents(t *testing.T) {
 	}
 }
 
+// TestBuildSupportBundleIncludesOrientationDocs guards that README.md —
+// written so an agent unfamiliar with bee can orient itself in the bundle
+// without reverse-engineering the layout — always ships at the bundle root
+// (sibling of manifest.txt, not buried under export/), and that
+// manifest.txt's file listing (generated after it's written) picks it up
+// too.
+func TestBuildSupportBundleIncludesOrientationDocs(t *testing.T) {
+	tmp := t.TempDir()
+	exportDir := filepath.Join(tmp, "export")
+	if err := os.MkdirAll(exportDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	archive, err := BuildSupportBundle(exportDir)
+	if err != nil {
+		t.Fatalf("BuildSupportBundle error: %v", err)
+	}
+	file, err := os.Open(archive)
+	if err != nil {
+		t.Fatalf("open archive: %v", err)
+	}
+	defer file.Close()
+	gzr, err := gzip.NewReader(file)
+	if err != nil {
+		t.Fatalf("gzip reader: %v", err)
+	}
+	defer gzr.Close()
+
+	tr := tar.NewReader(gzr)
+	var readmeMD, manifest string
+	var readmeAtRoot bool
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read tar entry: %v", err)
+		}
+		// Root-level: exactly one path separator ("<stage-prefix>/README.md"),
+		// not nested under export/ or anywhere else.
+		switch {
+		case strings.HasSuffix(hdr.Name, "/README.md"):
+			readmeAtRoot = strings.Count(hdr.Name, "/") == 1
+			body, _ := io.ReadAll(tr)
+			readmeMD = string(body)
+		case strings.HasSuffix(hdr.Name, "/manifest.txt"):
+			body, _ := io.ReadAll(tr)
+			manifest = string(body)
+		}
+	}
+
+	if readmeMD == "" || !readmeAtRoot {
+		t.Fatalf("expected README.md at bundle root, got content=%q atRoot=%v", readmeMD, readmeAtRoot)
+	}
+	if !strings.Contains(manifest, "README.md") {
+		t.Fatalf("manifest.txt file listing should include README.md:\n%s", manifest)
+	}
+}
+
 func TestMainBanner(t *testing.T) {
 	tmp := t.TempDir()
 	oldAuditPath := DefaultAuditJSONPath