readme: lead with the problem it solves, in plain words

.github/ISSUE_TEMPLATE/bug_report.md

@@ -3,7 +3,7 @@ name: Bug report
 about: Something tokenstash did that it should not have, or did not do that it should
 ---
 
-**Never paste a key value here** — not even a "test" one, not even partially. If the bug is that
+**Never paste a key value here**, not even a "test" one, not even partially. If the bug is that
 a value showed up somewhere it should not have, that is a security report: use
 https://github.com/krishhgg/tokenstash/security/advisories/new instead of an issue.
 
@@ -12,6 +12,6 @@ https://github.com/krishhgg/tokenstash/security/advisories/new instead of an iss
 - Agent, if one was involved (Claude Code / Codex / Cursor / Gemini CLI / none):
 
 **What you ran**, in order (`tokenstash doctor` output is useful; `tokenstash audit` is fine to
-paste — it never contains values):
+paste, because it never contains values):
 
 **What happened, and what you expected instead:**

.github/ISSUE_TEMPLATE/config.yml

@@ -2,4 +2,4 @@ blank_issues_enabled: true
 contact_links:
   - name: Security report
     url: https://github.com/krishhgg/tokenstash/security/advisories/new
-    about: A value reaching an agent, an approval that should not have happened, anything from SECURITY.md — privately, please.
+    about: A value reaching an agent, an approval that should not have happened, anything from SECURITY.md. Report it privately, please.

CONTRIBUTING.md

@@ -15,23 +15,23 @@
 }
 ```
 
-- `name` — the exact env var developers use.
-- `url` — where a new user creates the key, as deep a link as possible.
-- `steps` — what to click, in order. Write them as if for someone who has never used the product.
-- `pattern` — regex for the key format, so a bad paste fails immediately. Optional but valuable.
-- `check` — one cheap authenticated request that returns 200 with a valid key and 401 without. Optional.
+- `name`: the exact env var developers use.
+- `url`: where a new user creates the key, as deep a link as possible.
+- `steps`: what to click, in order. Write them as if for someone who has never used the product.
+- `pattern`: regex for the key format, so a bad paste fails immediately. Optional but valuable.
+- `check`: one cheap authenticated request that returns 200 with a valid key and 401 without. Optional.
   `auth` is `bearer` | `header:<Name>` | `prefix:<Scheme>` | `basic-user` | `query:<param>`; `method` defaults to GET.
   403 is read as "live, lacks permission", never as a dead key; if the provider answers something
   other than 401 to a bad key (Google: 400), list it in `reject_status`. Set `at_use: true` only if
-  the request is free and read-only enough to run before every delivery — without it the check
+  the request is free and read-only enough to run before every delivery. Without it, the check
   runs at paste time only.
-- `sensitive: true` — live payment keys, cloud credentials, anything with unbounded spend. These,
+- `sensitive: true`: live payment keys, cloud credentials, anything with unbounded spend. These,
   and any name the registry does not know, get their own card per directory; the broad pairing
   button never covers them. Use `sensitive_pattern` when only some values are dangerous (e.g.
   Stripe live vs test).
-- `generate: "base64:32"` — for local secrets with no vendor (`AUTH_SECRET`), so no human is involved.
+- `generate: "base64:32"`: for local secrets with no vendor (`AUTH_SECRET`), so no human is involved.
 
-Run `cargo test` — `registry_is_sane` validates every entry.
+Run `cargo test`. `registry_is_sane` validates every entry.
 
 ## Code