Rewrite README against the script-readme-rules skill

[necco-c]

The previous README was written by hand against the sigwire shape without loading the script-readme-rules skill. This rewrites it to the CLI variant.

Reviewer action items

• Apply the About description below
• Apply the topic tags below (the repo has a set applied that predates this run)
• Add a LICENSE file. The README states Dual BSD/GPL, grounded in the BPF program's SEC("license"), which covers the program rather than the repo. sigwire has the same gap, so confirm whether a root LICENSE is the yeet-src convention
• Confirm two flagged claims (below)
• Merge Fix build and verifier load on kernel 6.1 #1 (kernel 6.1 verifier fix) before or with this. main is currently red

About description

Live terminal MongoDB query monitor built on eBPF. Reads plaintext and TLS, grouped by query shape.

(104 characters.)

Topic tags

Apply one per line, per the logedex mangling incident:

mongodb
ebpf
observability
linux
yeet
showcase
bson
uprobes
kprobes
tls
query-shape
n-plus-one

What changed

Added

• ## Questions this tool answers, 9 questions placed after the primer per the CLI variant. The single largest gap: the previous README had no equivalent section. Personas confirmed as debugging, performance; SRE, platform, DevOps and network were deliberately dropped rather than answered with hedges.
• ## A 60-second primer on the MongoDB wire protocol, which the "query shape" vocabulary depends on.
• ## Have an agent set it up, including the demo-traffic step and the "it compiled is not it works" line.
• ## Reading it without a TTY, documenting the import.meta.main headless probe.
• ## Contents (four-row CLI split), and a <details> block for the (pid, requestID) correlation rationale.

Reshaped

• The one-sentence definition names the category ("live terminal MongoDB query monitor for Linux") instead of opening with the mechanism, and deliberately does not reuse redissnoop's noun ("profiler") so the two documents don't compete for one query.
• All five badges are linked with descriptive alt text; previously one of four was.
• Sample output moved under ## What you're looking at with a column-meaning table.
• ## Testing across kernels leads with the fact that motivates it and cites the real iov_iter.iov → __iov rename the matrix caught in Fix build and verifier load on kernel 6.1 #1.

Removed

• 17 in-sentence em-dashes. The one remaining is inside verbatim program output.
• ## Honest caveats → ## What it can't see.
• ## Community questions → ## FAQ, trimmed to exactly five and deduplicated against the questions section.
• The ## License section is two words, with no SEC("license") explanation.

Flagged claims

• "No meaningful overhead" (grounding 2). Consistent with the design and with the corpus answer, but not benchmarked on this script.
• Platform badge says "kernel 6.1 or newer" (grounding 2). 6.1 is the oldest kernel in the CI matrix and passes as of Fix build and verifier load on kernel 6.1 #1. That is a tested floor, not proof 5.x fails.

One deliberate omission

No make veristat / make veristat-matrix section. The CLI template calls for one, but this repo's Makefile defines only all, bpf, bundle, postgen, clean. sigwire's README documents those targets anyway, which is a bug in that README rather than something to propagate here. Worth either adding the targets to the template Makefile or fixing sigwire separately.

All 16 internal anchors verified against the actual headings.