Rebuild README for discoverability and honest limits

[necco-c]

Rebuilds the README so positioning and real user questions come before reference material. Content is preserved; almost nothing was deleted, several things moved and two limits were added.

Reviewer action items

• Apply the About description — needs repo admin; I have WRITE, so gh repo edit 404s.

  eBPF HTTP traffic inspector for Linux. Rank every endpoint, read any request, no proxy and no sidecar.

  102 chars. Replaces a 222-char line that was too long for GitHub's display, opened lowercase, contained an em-dash, and claimed "one Docker command" (the real command has nine flags; the tagline now says "one container").

• Apply the topic tags. Current set is 7 and browser/gui/web are noise.

  ebpf linux http observability http-monitoring network-monitoring traffic-inspection tcx docker devops sre dashboard yeet showcase
  

  Apply one per line or verify after applying. logedex shipped with four mangled tags (devop, linu, fleet-managemen) from a space-separated paste.

• Add a LICENSE file. The README asserts GPL-2.0 and no LICENSE exists. The claim is grounded in the BPF program's SEC("license") = "GPL", which covers that program rather than the repo.

• Confirm the HTTP/1.x-only caveat (below). Grounded in source, but it's a limit the previous README never stated.

The one substantive finding

is_http_request() matches nine hardcoded ASCII method tokens and is_http_response() matches a literal HTTP/ (httptop.bpf.c:158-176). HTTP/2 and cleartext h2c are binary with HPACK-compressed headers, so they never match and never appear.

This was undocumented and is probably the most common "empty dashboard" report waiting to happen, since plenty of internal services speak h2c. It's now stated in "What it can't see", it's the first cause listed in a new "dashboard is empty" FAQ entry, and h2c/gRPC users are pointed at grpcsnoop.

Please confirm nobody intended h2c to work.

What changed

Added

• "Questions this tool answers" above the fold: ten questions phrased the way people actually ask them ("One of my endpoints is returning 500s and the logs aren't telling me why"), weighted toward debugging, then network, then SRE.
• "Have an agent set it up": a paste-ready prompt carrying this repo's real traps (don't drop a cap flag, start the traffic generator first, Docker Desktop watches the VM).
• A "when should I use this instead of tcpdump, mitmproxy, or Pixie" answer, explicit about when to use something else.
• The category name in the one-sentence definition: "an eBPF HTTP traffic inspector for Linux".

Moved

• The environment table below the fold. It was at line 40, between the reader and everything explaining the tool.
• Demo traffic into the install flow. An empty dashboard and a broken one look identical, so seeding traffic belongs before "does it work", not in a section near the end.
• The incumbent comparison into the intro prose.

Reshaped

• Each capability flag now gets its reason, since dropping one fails quietly. The AppArmor line explains why this isn't --privileged.
• The alerts section is short prose plus a <details> block for the implementation rationale. The Block Kit ladder, the ReDoS canary reasoning and the yeet.alert-is-isolate-only constraint are all still there.
• "Honest caveats" → "What it can't see", plus the aggregates-vs-stream trust rule (recentDropped).
• Badges are links now, with descriptive alt text.
• ## One \docker run`→## Run it with Docker`. The inline code made a poor anchor and TOC entry; all three references updated, including the one inside the agent prompt.

Removed

• A "Who reaches for this" section (a heading over a persona list, sitting above a section that answered those people concretely).
• One narrator sentence.

Notes

• 378 lines. All 15 internal anchors validated against headings.
• Rendered through GitHub's markdown API during drafting, not eyeballed as source.
• ~515 MB image size dropped rather than repeated unverified.
• "No aggregation layer, one instance per host" is now stated as a design boundary in two places. Confirm that's intended rather than just unbuilt.