README: reflect ka-promote implementation + ka-import rename (Phase 8 of #22)

CLI verb table updates:
- ka-promote: new signature `<host>` (read fleet/<host>.yaml → cumulative.patch +
  manifest.lock). Marked [bin/ka-promote — implemented Phase 6, issue #22].
- ka-import: new verb name carrying the original ka-promote semantic
  (`<campaign> <patch-or-glob> --to <scope>`, promote patches into the
  scope-tagged tree). Unimplemented; today this is the regular git+PR workflow.
- ka-build / ka-install: signatures elaborated, marked as the next two verbs
  to implement (issues TBD).

Bootstrap reference build section:
- Header reframed: "before ka-* verbs existed" → ka-promote replaces step #1
  as of 2026-05-18.
- Baseline corrected: torvalds/linux not mmind/linux-rockchip (mmind doesn't
  ship plain v7.0 tag — caught in ka-promote Phase 3, fleet/fresnel.yaml fixed
  in the implementation commit).
- "Manual substitute" table gets a Status column. Row for ka-promote split
  into the old "import" semantic vs the new "manifest resolve" semantic, with
  the latter marked **automated 2026-05-18**.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -106,10 +106,12 @@ persistent, audit trail per item).
 ## Verbs (explicit, parameterized, audit-issue auto-filed)
 
 ```
-ka-promote <campaign> <patch-or-glob> --to <scope>
+ka-promote <host>          # resolve fleet/<host>.yaml → cumulative.patch + manifest.lock   [bin/ka-promote — implemented Phase 6, issue #22]
+ka-import <campaign> <patch-or-glob> --to <scope>   # patches from campaign → scope-tagged tree (today: manual git workflow)
 ka-close <campaign> --status success
 ka-abandon <campaign> --keep-as-archive | --purge-from-fleet
-ka-install <host>
+ka-build <host>            # render PKGBUILD template with cumulative b2sum, run makepkg     [next verb, issue TBD]
+ka-install <host>          # scp + pacman -U + extlinux/mkinitcpio + heartbeat               [last verb, issue TBD]
 ka-keep <job-id> [--for <duration>]
 ka-pause-prune  / ka-resume-prune
 ka-restore-archive <job-id>
@@ -120,6 +122,13 @@ ka-migrate-tree --from <p> --to <p>
 ka-wake-data               # wraps wake-host data through His
 ```
 
+Note: the original spec had `ka-promote <campaign> <patch-or-glob> --to <scope>`
+("promote patches from a campaign into the canonical tree"). That semantic
+moved to `ka-import` to free `ka-promote` for the manifest-resolution role
+its issue (#22) and the implemented `bin/ka-promote` actually fulfil. `ka-import`
+remains unimplemented — patches still land in `patches/` via the regular git
++ PR workflow.
+
 Conversational invocation triggers a y/n confirmation enumerating what will
 happen. Direct CLI invocation executes immediately.
 
@@ -226,15 +235,17 @@ via `ka-snooze <issue-id> [--for <duration>]`.
 
 ## Bootstrap reference build (2026-05-09 — fresnel)
 
-First end-to-end run, before any `ka-*` CLI exists. Documented here as the
-canonical worked example so future ka-* implementations have a concrete
-substrate to replay. Issue #3 (fresnel DTS persistence) closed by this
-build.
+First end-to-end run, before `ka-promote` / `ka-build` / `ka-install` existed.
+Documented here as the canonical worked example; the substrate that the ka-*
+verbs are/will-be implemented against. Issue #3 (fresnel DTS persistence) closed by this
+build. `ka-promote` (issue #22) replaced the manual step #1 below as of 2026-05-18.
 
 ### Inputs
 
-- **Baseline:** mmind/linux-rockchip @ `v7.0` (Heiko Stübner / Collabora,
-  via kernel.org).
+- **Baseline:** torvalds/linux @ `v7.0` (verified during ka-promote Phase 3,
+  issue #22 — mmind/linux-rockchip does not ship a plain `v7.0` tag despite
+  earlier docs; mmind kept in fresnel.yaml as informational
+  `patch_authoring_context`).
 - **Patches** (scope `board/pinebook-pro`):
   - `0001-arm64-dts-rk3399-pinebook-pro-add-OC-OPP-tables-1704-2184.patch`
   - `0002-arm64-dts-rk3399-pinebook-pro-enable-hdmi-sound.patch`
@@ -249,13 +260,14 @@ build.
 
 ### Manual substitute for each ka-* verb
 
-| Designed verb | What we did manually |
-|---|---|
-| `ka-promote fresnel-fourier <patches> --to board/pinebook-pro` | Authored 3 patches with proper headers/scope tags, pushed to `marfrit/kernel-agent/patches/board/pinebook-pro/` via Gitea contents API as `claude-noether`. |
-| `ka-build fresnel` | On boltzmann: cloned linux v7.0 from kernel.org, ran `makepkg -s --skipchecksums --skippgpcheck` against `marfrit-packages/arch/linux-fresnel-fourier/PKGBUILD`. Native aarch64 (boltzmann is RK3588). One headers-pkg bug discovered (`ln -sr` on missing parent dir) and fixed mid-flight. Repackaged. |
-| `ka-sign + push` | scp pkgs hertz → `sudo /opt/herding/bin/marfrit-publish-arch aarch64 <pkg>` per pkg. Script signs with key `92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C`, runs repo-add, rsyncs to nc. |
-| `ka-install fresnel` (consent-via-action) | `sudo pacman -U /tmp/<pkg>` over LAN scp (HTTPS to nc was throttled by fresnel's wifi). pacman post-transaction hook updated extlinux. mkinitcpio run manually because the standard hook trigger watches `vmlinuz` not `Image`. |
-| Bar 1..3 verification | SSH heartbeat OK, `pacman -Q linux-fresnel-fourier` = `7.0-1`, post-reboot cluster0 1.704 GHz / cluster1 2.184 GHz confirmed. |
+| Designed verb | What we did manually | Status |
+|---|---|---|
+| `ka-import fresnel-fourier <patches> --to board/pinebook-pro` (originally named `ka-promote` in this row) | Authored 3 patches with proper headers/scope tags, pushed to `marfrit/kernel-agent/patches/board/pinebook-pro/` via Gitea contents API as `claude-noether`. | still manual — `ka-import` unimplemented |
+| `ka-promote fresnel` (new — manifest → cumulative.patch + manifest.lock) | n/a (didn't exist) | **automated 2026-05-18, issue #22** |
+| `ka-build fresnel` | On boltzmann: cloned linux v7.0 from kernel.org, ran `makepkg -s --skipchecksums --skippgpcheck` against `marfrit-packages/arch/linux-fresnel-fourier/PKGBUILD`. Native aarch64 (boltzmann is RK3588). One headers-pkg bug discovered (`ln -sr` on missing parent dir) and fixed mid-flight. Repackaged. | still manual — next verb to implement |
+| `ka-sign + push` | scp pkgs hertz → `sudo /opt/herding/bin/marfrit-publish-arch aarch64 <pkg>` per pkg. Script signs with key `92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C`, runs repo-add, rsyncs to nc. | still manual — folded into `ka-build` |
+| `ka-install fresnel` (consent-via-action) | `sudo pacman -U /tmp/<pkg>` over LAN scp (HTTPS to nc was throttled by fresnel's wifi). pacman post-transaction hook updated extlinux. mkinitcpio run manually because the standard hook trigger watches `vmlinuz` not `Image`. | still manual — last verb to implement |
+| Bar 1..3 verification | SSH heartbeat OK, `pacman -Q linux-fresnel-fourier` = `7.0-1`, post-reboot cluster0 1.704 GHz / cluster1 2.184 GHz confirmed. | folded into `ka-install` |
 
 ### Files / locations involved