app: ship a README.md in every support bundle and blackbox capture

An agent handed a bundle path had no way to know its layout without
grepping through random logs first — confirmed by watching a separate
session read bee-nvidia.log before anything else on a real bundle. Embeds
a single README.md (bee-embed, internal/app/assets/) explaining what bee
is and giving direct answers to the questions someone analyzing a bundle
is most likely to ask (did the tests pass, what hardware is this, is a
service healthy, RAID/GPU/NVLink state, etc), written at the bundle root
by both BuildSupportBundle (support-bundle archive root, sibling of
manifest.txt) and blackboxWorker.syncCycle (removable-media boot-folder
root, which otherwise has no manifest.txt-equivalent pointing anywhere).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/app/support_bundle_test.go

@@ -0,0 +1,31 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestWriteBundleDocs covers the primitive shared by both consumers —
+// BuildSupportBundle (support-bundle archive root) and blackboxWorker.syncCycle
+// (removable-media boot-folder root) — since a blackbox capture has no
+// manifest.txt/tar-archive test harness to drive syncCycle end-to-end, but
+// both call this same function at their respective root.
+func TestWriteBundleDocs(t *testing.T) {
+	root := t.TempDir()
+	if err := writeBundleDocs(root); err != nil {
+		t.Fatalf("writeBundleDocs: %v", err)
+	}
+
+	readme, err := os.ReadFile(filepath.Join(root, "README.md"))
+	if err != nil {
+		t.Fatalf("read README.md: %v", err)
+	}
+	if !strings.Contains(string(readme), "bee-audit.json") {
+		t.Fatalf("README.md should explain where the hardware inventory lives:\n%s", readme)
+	}
+	if !strings.Contains(string(readme), "overall_status") {
+		t.Fatalf("README.md should explain how to check SAT pass/fail:\n%s", readme)
+	}
+}