Fix cMCP tutorial trust assumptions and clarify the reader path

[imran-siddique]

cMCP's documentation described the software demo as a real data leak blocked inside a TEE, used receipt-supplied hashes as approval inputs, and let a fresh partially_verified result pass a consuming-job example that printed “Claim verified.” Readers now get a clear first-demo path, an architecture diagram with explicit component boundaries, independently computed expected hashes, and a consumer gate that rejects every result below full verification.

The longer quickstart includes environment setup, terminal roles, expected exit codes, and cleanup. The architecture explanation distinguishes TPM evidence from memory isolation and signed commitments from transcript replay. Search metadata and the model-facing description match the visible page.

Validation: strict MkDocs build passed. The Markdown-driven smoke check exercised a 403 denial, a 200 allowed mock call, the two-call signed summary, six passing software checks with independently computed hashes, and expected software-mode exit 1. The inspection example runs; the acceptance example rejects hardware-missing, policy-mismatch, and unverified results. Reproducing the old example confirmed it accepted fresh partial results with both missing hardware and a failed policy hash. New PR CI builds docs and runs the examples.

This changes documentation and its validation, not runtime authorization or cryptographic verification. Hardware platforms were not exercised. Diagram visual verification is pending deployment.