feat: crucible wrapper sync (#3)

Reviewed-on: #3
Co-authored-by: vickydotbat <vickydotbat@tutamail.com>
Co-committed-by: vickydotbat <vickydotbat@tutamail.com>

README.md

@@ -41,6 +41,30 @@ See [`docs/migration-from-nwn-tool.md`](docs/migration-from-nwn-tool.md) for wha
 was done and what remains (the consumer `--manifest/--source/--out` flag contract
 is the open Phase-6 item).
 
+## Quick start (no Nix)
+
+Teammates without Nix don't build anything — they run the bootstrap wrapper,
+which downloads the latest released `crucible` for your OS and runs it:
+
+```bash
+./crucible            # interactive menu (pick a command)
+./crucible module build
+./crucible topdata validate-topdata
+```
+
+Windows (PowerShell):
+
+```powershell
+.\crucible.ps1 module build
+```
+
+The binary is cached under `~/.cache/crucible/<version>/` (`%LOCALAPPDATA%\crucible`
+on Windows); `--repo-local` caches inside the repo instead. Private releases:
+set `CRUCIBLE_TOKEN` or write the token to `~/.config/crucible/token`.
+
+Only the **music** builder needs `ffmpeg`; everything else has zero dependencies.
+If you run a music command without it, Crucible prints a per-OS install hint.
+
 ## Develop
 
 Self-contained (D8) — a host with only Nix can run everything:
@@ -58,12 +82,18 @@ This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 
 ## CI
 
-PR-first (D7): every check runs on pull requests and on push to `main`.
+PR-first (D7): checks run on pull requests and on push to `main`; the only
+publish event is a `v*` tag (see `sow-docs/runbooks/ci-trigger-standard.md`).
 
-- `test.yml` — vet, test, shellcheck, yamllint, binary smoke.
-- `build-image.yml` — build `registry.westgate.pw/deployment/crucible:<sha>`; publish
-  only on `main`. PRs build but never push. No mutable tags.
-- `release.yml` — tag-gated binary bundles; image re-tag is wired in Phase 6.
+- `test.yml` — vet, test, shellcheck, yamllint, binary smoke (PR + main).
+- `test-image.yml` — build the OCI image to prove it compiles (PR + main, no push).
+- `build-binaries.yml` — cross-build all targets (PR + main); on a `v*` tag, upload
+  the binaries, `SHA256SUMS`, and the wrappers to the Gitea release.
+- `build-image.yml` — on a `v*` tag, build and publish
+  `registry.westgate.pw/deployment/crucible:<sha>`.
+- `publish-image.yml` — manual `workflow_dispatch` break-glass republish.
+- `sync-wrappers.yml` — on a `main` push that touches `wrappers/`, auto-PR the
+  canonical wrappers to the consumer repos in `wrappers/consumers.txt`.
 
 ## Consumers