docs: add Sourcey-generated llms.txt

[Arinbus]

Summary

• add a repository-root llms.txt generated with Sourcey 3.6.5 from audited ModelFuzz source at commit 77569bbdd3b61f7226d5447c9f8f61b6b16375e0
• give agents six current main-branch pointers covering the README, assistant guide, scanner, contribution policy, security policy, and changelog
• use the concise maintainer-requested summary while retaining honest scope details in the structured entries

Per the maintainer reply in #57, this PR deliberately adds the content only. The separate site source can serve the merged file at /llms.txt as text/plain.

Generation provenance

Sourcey generated the heading, summary, section, titles, descriptions, and ordering from deterministic wrappers around the audited commit-pinned repository files. Two independent builds were byte-identical. Because the project will deploy only /llms.txt rather than Sourcey's companion HTML pages, the finalizer replaces only the six generated site-local hrefs with current first-party main URLs, as requested in review.

• Sourcey: 3.6.5
• raw Sourcey SHA-256: 77c93d9f692871528a9cd6addcd9d5d4d645e43570cba949c5057ed6f716143c
• proposed file SHA-256: bc2bcdd6a6327f5caacb608d77198cd63598447ec01e675aaa57a43e191d5662

AI assistance and deterministic tooling were used for preparation and verification; the final one-file diff was checked against the maintainer's two requested changes.

Test plan

• deterministic Sourcey double build
• generation contract: 5 passed
• upstream test suite: 110 passed
• ruff check .
• mypy src
• wheel and sdist build
• all six reader-facing GitHub targets return HTTP 200

Closes #57

[higagan]

Thanks for this — the content is honest and the scope is right (repo-root copy only, deploy is separate). Two things before merge:

1. URLs are pinned to a commit hash. Every link points at 77569bb (v0.3.9). That's stable but frozen — when 0.4.0 ships, the llms.txt will still point at 0.3.9's README. Two options:

• Switch to main URLs (always current, but can shift if a file moves)
• Keep the pin and regenerate llms.txt as part of the release checklist

I'd lean toward main — the file is short enough that a broken anchor is a one-line fix, and a stale llms.txt is worse than a occasionally-shifted link.

2. The summary line is dense. The blockquote crams the description, install command, PyPI link, and scanner link into one paragraph. The llms.txt convention prefers a short one-liner, then structured sections. Something like:

> Runtime guardrails for AI agents at the tool-call execution layer. `pip install modelfuzz`.

The detail belongs in the section links below, not the summary.

Minor: the Sourcey provenance metadata (SHA-256 hashes, generation contract) in the PR body is thorough but doesn't need to ship in the file or the commit message — it's useful for review, not for the reader.

Happy to merge once the URLs are sorted.

[Arinbus]

Both requested changes are addressed in e9fa6f7: all reader-facing links now follow main, and the summary is the proposed one-liner. The file was regenerated from the audited inputs; the generation contract (5 passed) and upstream suite (110 passed) are green, and the PR body/hashes are updated. Ready for re-review.

[higagan]

Clean, well-scoped docs addition — the descriptions accurately reflect the source files. One change I'll make on top: swap the six github.com/.../blob/main/... links for raw.githubusercontent.com/.../main/... so agents fetch plain text instead of GitHub HTML. Approving as-is and applying that swap myself.