Implement read-only vault domains (#6)

README.md

@@ -34,6 +34,8 @@ GnuPG compatibility evidence are documented in
 Hierarchical `.gpg-id` resolution, signed policies, selective reencryption, and
 the rollback/commit contract are documented in
 [`docs/recipient-policies.md`](docs/recipient-policies.md).
+Typed list/show/find/decrypted-grep models and secret presentation selection are
+documented in [`docs/read-domains.md`](docs/read-domains.md).
 
 ## Project layout