docs(readme): canonical tagline above the descriptive line (TAG-1)

[jothimani-rajendran]

What

README.md line 7 becomes the canonical tagline; the old descriptive sentence stays, unchanged, as a plain line 8 below it (same pattern as chock-cursor-plugins#10). Nothing else changes.

• Before (line 7): <strong>Chock policies as Codex plugins — a real <code>PreToolUse</code> deny hook for guards, a <code>Stop</code> gate for writes, both held untrusted until you approve them.</strong>
• After: line 7 <p align="center"><strong>A kill switch for your Codex agent's wrong moves.</strong></p>; line 8 <p align="center"> + the old sentence, not bold.

Owner decision (2026-10-13)

Tagline (exact): A kill switch for your coding agent's wrong moves. Use an ASCII apostrophe everywhere so README, PyPI and JSON/YAML agree byte for byte.

Plugin repos (claude, cursor, codex, copilot, devin): The README line-6 tagline. Per-agent form: A kill switch for your <Agent> agent's wrong moves. … Owner authorization 2026-10-13: the owner asked for the tagline on every repo. These READMEs are hand-maintained, so the worker edits the tagline line directly, that line only, one draft PR per repo.

Codex gets the kill-switch form: its guards ship a real PreToolUse deny hook (pre-action block).

Checks (measured)

• chock marketplace build --dist . --check --tree codex at the catalog's .framework-ref (a2dd3de, chock 0.15.2): Marketplace index matches the plugin tree (31 plugins).
• chock marketplace build --dist . --tree codex rewrites only chock-market.lock and PLUGINS.md, both unchanged; README.md is not regenerated, so the edit survives a rebuild.
• git grep -n "guardrails for AI coding agents": 0 hits.

Generated-only/verify is already red on main (push run 35922483165 on bc69d75, before this PR), from regenerate-and-diff drift that predates this change.

🤖 Generated with Claude Code

---

Generated by Claude Code

[jothimani-rajendran]

Generated-only / verify is red (run 38335478835), and the cause isn't this PR.

• The first step, "Verify the lockfile and index match the published tree", passes. The failing step is "Regenerate from the catalog and diff".
• The same check was already red on main: push run 35922483165 on bc69d75.
• I reproduced it locally at framework a2dd3de against current chock-catalog. The regenerate step changes 251 paths, and PLUGINS.md now lists 54 plugins against 31 published. None of those paths is README.md, the only file this PR changes.
• The tree has drifted since the last publish, so a catalog publish fixes this. No fix exists that this PR could carry: hand-editing generated output is exactly what this check forbids.

No re-run: the failure is deterministic.

---

Generated by Claude Code