Fix documentation drift from the resolved-open-questions pass

IMPLEMENTATION.md hadn't been updated after the second implementation
pass — the data model SQL was missing prev_ciphertext/prev_nonce,
can_write, and the entire vault_grants_previous table; the Rotation
section described the old "overwritten, not versioned" behavior
(the opposite of what got built); the crypto scheme section still
said "read implies write" while the Resolved design decisions section
below it said the opposite; the CLI surface listing was missing
--purge/--previous/--read-only; and "What was verified" only covered
the first verification pass, not the read-only/rollback/purge one.

README's Core model was missing any mention of the retention/purge
behavior or read/write grant scoping. INTEGRATION.md now recommends
--read-only for deploy identities specifically, now that the
capability exists.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

INTEGRATION.md

@@ -26,6 +26,11 @@ printed public key to whoever runs `keep recipient add`, then
 deploy from that machine just works — no more "wait, what's the DB
 password again" when setting up a new box.
 
+A deploy identity should almost always be granted **read-only** access
+(`keep grant <vault> <deploy-recipient-id> --read-only`) — it only ever
+needs to `pull`, and a read-only grant means a compromised deploy box
+can't also rotate the vault or add itself more recipients.
+
 ## Pattern: docker-compose reading a local `.env`
 
 A common shape — `docker compose up -d` reads `environment:` values from