docs: bring README index current (build state, red-team review, HQ runbook)

- Add a "Build state" section pointing to STATUS.md / BUILDING.md as the
  entry point now that this is a working codebase, not just a plan.
- Add docs/18-RED-TEAM-REVIEW.md and DEPLOY-HQ.md to the index.
- Reorder the "start here" pointer to STATUS.md first.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -11,6 +11,17 @@ product.
 **North star:** the fastest, easiest counter workflow in the market. The customer in line
 never waits because of the software, and purchase entry is never a burden.
 
+## Build state (start here)
+
+This is now a working codebase, not just a plan. Current state, run instructions, and the
+live-vs-wireframe breakdown live in **[STATUS.md](STATUS.md)** and **[BUILDING.md](BUILDING.md)**.
+
+In brief: a web-app POS + back office served by a Node store-server over a portable data
+layer (SQLite dev slice; Oracle 12c adapter pending the Classic DDL). Live and verified
+end-to-end: billing (keyboard-first, offline-capable, B2B/IGST), purchases with batch/
+expiry, returns/credit notes, and GST returns (GSTR-1/3B). A full adversarial security
+review + P0–P2 remediation is complete — see [docs/18-RED-TEAM-REVIEW.md](docs/18-RED-TEAM-REVIEW.md).
+
 ## Planning documents
 
 | Doc | What it covers |
@@ -32,5 +43,7 @@ never waits because of the software, and purchase entry is never a burden.
 | [docs/15-EDITIONS.md](docs/15-EDITIONS.md) | Lite/Standard/Pro/Enterprise: privileges, limits, costs — all configurable DB rows |
 | [docs/16-PROJECT-RULES.md](docs/16-PROJECT-RULES.md) | The 26 hard rules (Tables Rule, money rules, config-over-code, counter rules) |
 | [docs/17-SCALE-AND-INTEGRATIONS.md](docs/17-SCALE-AND-INTEGRATIONS.md) | The 7 committed scale gaps + full integrations catalog with status |
+| [docs/18-RED-TEAM-REVIEW.md](docs/18-RED-TEAM-REVIEW.md) | Adversarial security review + remediation record (all findings closed) |
+| [DEPLOY-HQ.md](DEPLOY-HQ.md) | Go-live runbook for the HQ ops console (apps/hq) |
 
-Start with 00-VISION, then 02-ARCHITECTURE, then 04-ROADMAP.
+Start with STATUS.md for what's built; then 00-VISION, 02-ARCHITECTURE, 04-ROADMAP for the plan.