docs: lead with the command that works, and correct a wrong claim

README.md

@@ -32,18 +32,18 @@ PID 1 kills the machine.
 
 ## Try it
 
-You need [Docker](https://docs.docker.com/get-started/get-docker/) and a Rust
-toolchain. Two commands:
+You need [Docker](https://docs.docker.com/get-started/get-docker/) and nothing
+else. No Rust, no virtual machine, no kernel.
 
 ```bash
-cargo xtask fetch --arch x86_64   # a kernel and a busybox, into target/
-cargo xtask demo                  # build the image and run it
+docker run --rm --name oxinit-demo -p 8080:8080 ghcr.io/youhide/oxinit:demo
 ```
 
-Or pull the image, which tracks `main` and needs no toolchain at all:
+The image tracks `main` and is 4.6 MB. To build and run it yourself instead:
 
 ```bash
-docker run --rm --name oxinit-demo -p 8080:8080 ghcr.io/youhide/oxinit:demo
+cargo xtask fetch --arch x86_64   # a kernel and a busybox, into target/
+cargo xtask demo                  # build the image and run it
 ```
 
 oxinit boots as PID 1 inside the container and starts a handful of small
@@ -88,8 +88,9 @@ for each to actually be gone, and exits `0`. Most container images have to be
 killed after a ten-second grace period; that shows up as exit code 137.
 
 The units the demo runs are in [demo/](demo/), one small file each, and they
-are meant to be read. The image is 4.6 MB — statically linked against musl,
-`FROM scratch`, no base image and no shared libraries.
+are meant to be read. The image is that small because oxinit is statically
+linked against musl and the image is `FROM scratch` — no base image, no shared
+libraries, nothing in it but the three binaries and the units.
 
 ## Why
 

ROADMAP.md

@@ -990,11 +990,15 @@ And CI checks that the image reference in the README is the one the publish
 step pushes. That is the half a test on a locally built image structurally
 cannot cover, and it is the half that failed.
 
-One thing here is not automatable: a package pushed by Actions is **private by
-default**, and an anonymous `docker run` against a private package fails with
-exactly the `denied` that was reported. Making it public is a one-time setting
-on the repository's package page, and it belongs to whoever owns the account
-rather than to CI.
+One claim written here while fixing it was wrong, and is corrected rather than
+quietly deleted: that a package pushed by Actions is private by default and
+would need a manual visibility change. It is not, for a package pushed from a
+public repository — it inherits the repository's visibility. Verified by
+logging out of the registry and running the reported command, which now pulls
+and runs.
+
+The lesson is the same one the bug taught, applied to the fix: the reason to
+run the command is that reasoning about what it will do is not the same thing.
 
 ## Not doing, and why