bootstrap: neutralize README.md + REVIEW_POLICY.md hub identity in consumers (follow-up to #744)

[nathanjohnpayne]

Follow-up from #744

#744 fixed the wizard's minting of false hub identity into consumers (BRAND.md, .ai_context.md, docs/agents/repository-overview.md, AGENTS.md packaging note, hub-only machinery docs). Two adjacent files were deliberately out of #744's file-list scope but carry the same class of consumer-facing falsehood via the lexical mergepath → <repo> substitution:

README.md

• Heading + tagline become "# " / "Reference implementation of the AI Agent Tooling Standard." — false for a consumer (same claim bootstrap: stop duplicating mergepath hub identity into consumer repos at creation time #744 removed from BRAND.md/repository-overview.md).
• The "Key Files" table lists files that are excluded from consumers and so are dead rows there: mergepath/playground/index.html, scripts/policy-sim.sh, .mergepath-sync.yml (all pre-existing excludes), plus it references the Playground/Cockpit/Tiebreaker/Checks surfaces via BRAND.md.

REVIEW_POLICY.md

• The § Wave audit section (and other propagation/wave passages) describe hub-only machinery a consumer doesn't run (scripts/wave-audit.sh, sync-to-downstream.sh, the manifest), and reference docs/agents/propagation-ordering.md (excluded from consumers). It lands verbatim in every consumer.

Suggested approach

Mirror the #744 pattern: scaffold a neutral consumer README.md (or scrub the identity heading + the dead Key-Files rows at bootstrap), and either gate the REVIEW_POLICY.md hub sections behind a "hub-only" note or scrub them in the consumer copy. Same bootstrap step (bootstrap::_scaffold_consumer_identity) is the natural home.

Propagation-side invariant is already enforced by #743 (identity-docs denylist in check_sync_manifest).