docs: refresh README first-run positioning

[TacoRocket]

Summary

• What changed:
  • rewrote the README top section to lead with attack-path positioning, frictionless first-run commands, and real sample output
• Why:
  • make the tool value obvious faster for security operators evaluating AzureFox for the first time

Validation

• ruff check .
• pytest -m "not integration"
• Updated schemas/golden outputs if command contract changed

Risk and Rollback

• Risk level: low
• Rollback plan:
  • revert this README-only commit if the positioning or example block is not the direction we want

Scope Check

• Focused, single-purpose change
• No secrets introduced