Close out RISK-WP-0001: task notes, README, repo classification

T01, T02, T04-T08 done. T03 stays in progress: the escalation rule is
written and proposed, and it is not adopted until the custodian rules on
it — an unadopted rule is worse than an unwritten one because it looks
like coverage.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -11,4 +11,29 @@ register.
 It does not fix things: findings route to the repo that owns the defect. It
 does not host: `policy-nexus` is the publication surface.
 
+## Where things are
+
+- **`REGISTER.md`** — the whole register, one screen. Generated; do not edit.
+- **`findings/`** — one file per finding. `findings/README.md` is the filing
+  contract for reporting repos.
+- **`notes/`** — seen, deliberately below the floor. Not graded, not reviewed.
+- **`docs/method/`** — how this repo decides:
+  [severity](docs/method/severity.md),
+  [disclosure](docs/method/disclosure.md),
+  [escalation](docs/method/escalation.md),
+  [review and expiry](docs/method/review.md).
+- **`docs/rulings/`** — the reasoning behind each grading, dated.
+- **`workplans/`** — the work.
+
+## Using it
+
+```
+make register   # rebuild REGISTER.md from findings/
+make check      # verify the index, then report what is going quiet
+```
+
+`make check` reports ungraded findings, overdue reviews, stalled remediation,
+embargoes due for re-decision, escalations awaiting the operator, and what is
+owed at the production transition. It changes nothing.
+
 - Intent: `INTENT.md`