docs(ux): warm refusal tone, plain-English setup, inline cap-change walkthrough

[ryanio]

Summary

Iteration on Matthias's UX feedback on the template. Copy and flow tweaks only — no architecture or safety-logic changes.

• Agent tone. Refusals now lead with empathy and explain what the user can do, not just what they can't. Communication Style explicitly prefers plain words ("owner key on your computer") over jargon ("off-machine authorization signature") and bans stiff phrases like "policy violation" from user-facing text.
• Off-machine "ceremony" → "one-time setup on your computer." Phase 1 renamed and reframed so the why ("this is what makes the cap real") leads the step. The user-facing block opens with the motivation in plain language, then three short commands.
• Bootstrap restarts. The single Pinata reload is now framed as "saving your secrets — Pinata reloads me, ~30 seconds, this is the only one you'll see," so users don't read it as a crash. README clarifies setup is exactly one reload + one step on the user's computer.
• Cap-change guidance. New ## Changing the cap section in SOUL.md gives the agent an inline walkthrough (acknowledge → show the new policy → install CLI → run policy-update script → verify) instead of bouncing the user to an external URL with no hand-off. Same pattern applies to any other policy field.

Test plan

• Skim SOUL.md ## Changing the cap and verify the linked policy-administration URL still resolves
• Re-read BOOTSTRAP.md Phase 0d + Phase 1 user-facing quotes out loud — confirm they read warm but not chatty
• Confirm validate.yml passes (manifest + workspace files + link check unchanged)
• Manual sanity: search the repo for remaining user-facing instances of "ceremony", "authorization signature", or "restarting" and confirm the only hits are agent-internal technical context

🤖 Generated with Claude Code