docs: rewrite the README for a first-time reader

[JacobPEvans-personal]

Stacked on #60.

What

Rewrote README.md for someone who has not used this tool, and may not know Splunk.

• Before you start — the two prerequisites, and the common trap of using the web port 8000 instead of the management port 8089.
• Installation — three commands, with a plain explanation of why every later command starts with .venv/bin/.
• Windows — one table of the three things spelled differently, instead of a duplicated parallel set of instructions.
• Running the tests — a summary table of the five groups, then one section each with the exact variables and the exact command to copy.

Why

The old README assumed prior knowledge and described the test suites in prose, so running any of them meant reconstructing environment variables out of paragraphs. The write suite in particular needs fixture files staged inside the Splunk container, which was documented nowhere outside the CI workflow — so nobody could actually run it locally.

Proof

Claims in the README were checked, not assumed:

• Every documented test path collects: unit 897, Enterprise read 61, Enterprise write 115, Cloud read 68, ACS contract 1.
• The claim "they never quietly pass by skipping" was verified by opting in while withholding a required variable — the Enterprise lane produced 61 errors and the Cloud lane 68, rather than skipping.
• markdownlint-cli2 and the full pre-commit hook set pass.

Note

The Docker block for the write suite is transcribed from what CI actually does, including the fixture staging and the wait for first boot, so a local run matches the CI run step for step.