docs(s53): README two-mode CLI matrix + honesty-scoped learning-loop claims + CHANGELOG catch-up

README: the stale one-line CLI mention replaced by the two-mode flag matrix (single-project vs
--portfolio), runnable 'uv run python -m portfolio_optimiser.run ...' examples, the --outbox-dir
!= --verdict-dir self-contamination warning (documented, not enforced), and the --decision/
--rationale inert-in-portfolio note. Honesty scoping: the prior-verdict fold (the learning step)
is stated to happen ONLY on the --bundle-dir path; a --docs-dir-only run is single-shot (no fold).
CHANGELOG [Unreleased]/Added: S5.3 CLI-parity entry (six flags + portfolio mode + load_dimension +
recipe doc) plus catch-up for the shipped-but-undocumented S4.1 (preflight), S4.2 (--live-dry-run),
S5.1 (hitl CLI), S5.2 (notify); stale test count 237 -> 431. extending.md verified accurate (B11
notifier note stands verbatim — main() auto-wires no notifier; no CLI section to sync), left
unchanged.

SC4 honesty grep clean (each hit in bundle-path context, none on a fold-less path):
  grep -rniE 'learning loop|learns from|self-improv' README.md docs/extending.md CHANGELOG.md
  README:11 (system-level) :56 (wiki substrate) :67 (8-step bundle loop);
  CHANGELOG:13 (gated ExpeL fold) :17 (offline simulation). Full suite 431 passed (no code touched).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNNiJRk1sSwxgVLS5AobT1

CHANGELOG.md

@@ -18,7 +18,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   (`uv run python -m portfolio_optimiser.simulation`) — plumbing proof, not live-model proof.
 - Framework-neutral shared core in `shared/`: OKF concept + example bundle, golden validator
   suite, and the expert-reviewer persona as an Agent Skill.
-- Test suite: 237 passing tests (4 skips are live-provider-only), every wired seam covered by a
+- CLI parity (S5.3): `run.py` drives the whole method from the command line in **two modes** —
+  single-project (`--dimension-config`, `--outbox-dir`/`--run-id`, plus the already-wired
+  `--bundle-dir`/`--verdict-dir`) and portfolio (`--portfolio` with `--goals`/`--ledger`), the
+  latter printing an observable `goal reached: …` line when a savings goal is met. Adds a
+  fail-fast `load_dimension` loader and structured refusals (rc 1, no traceback) for misuse and
+  mode-exclusivity violations. The prior-verdict fold is on the `--bundle-dir` path only; a
+  `--docs-dir`-only run is single-shot.
+- Azure/Foundry offline preflight config gate (`preflight.py`, S4.1).
+- Offline live-dry-run drill (`--live-dry-run`, S4.2): walks the whole path up to the eager
+  client build and stops before the first model call — zero chat calls.
+- Out-of-band HITL verdict routing CLI (`hitl.py`, S5.1): code-prefix routing on the candidate id.
+- Expert-notification contract (`notify.py`, S5.2): the declared `Notifier` with `ConsoleNotifier`,
+  `FileNotifier` (byte-deterministic JSONL), and `WebhookNotifier`, plus a fail-fast
+  `build_notifier`; the webhook is the only egress point, fail-closed behind an explicit per-run
+  `allow_egress` opt-in. Not auto-wired into `run.py`.
+- `docs/knowledge-base-recipe.md` (S5.3, D-H item 1): the documented team process (technical +
+  domain expert) for building a knowledge base, with the honest 1–2 week expectation.
+- Test suite: 431 passing tests (4 skips are live-provider-only), every wired seam covered by a
   load-bearing test that goes red when the seam is detached.
 
 ### Notes