docs(readme): hero screenshot, differentiators, status, TOC

Add docs/img/gnoma-tui.png as a hero image so visitors see the TUI
above the fold instead of a wall of text. Pull the bandit router,
prefer-policy, SLM, and built-in firewall out of buried sections into
a 'What makes gnoma different' bullet list. Add a Status block flagging
pre-1.0 and a table of contents. Move the pygmy-owl naming note and
upstream/mirror URLs into a footer About section.

README.md

@@ -10,11 +10,55 @@ to the best available model — cloud or local — through a multi-armed bandit
 router, executes tools on your behalf, and stays extensible through hooks,
 skills, MCP servers, and plugins.
 
-Named after the northern pygmy-owl (*Glaucidium gnoma*); agents are called
-**elfs** (elf owl).
+![gnoma TUI showing a routed turn](docs/img/gnoma-tui.png)
 
-- **Upstream:** <https://somegit.dev/Owlibou/gnoma>
-- **GitHub mirror:** <https://github.com/VikingOwl91/gnoma>
+*Every turn shows which arm the router picked and why — here a local
+`qwen3:14b` was selected for a `generation` task.*
+
+## What makes gnoma different
+
+- **Multi-armed bandit router.** Per-prompt arm selection based on
+  capability gates, declared `Strengths`, latency, and cost. Visible in
+  the TUI on every turn — no black box.
+- **`[router].prefer = local | cloud | auto`.** Pin routing toward local
+  models, cloud, or let the bandit decide. Offline-first workflows still
+  reach for Claude when the local model would obviously flail.
+- **Tier-0 SLM routing.** A tiny local model classifies each prompt and
+  handles trivial tasks itself, keeping the heavy provider for real work.
+- **Built-in network firewall + secret scanner.** Paths are canonicalised
+  (TOCTOU-safe), network egress is gated, tool output is scanned for
+  secrets before reaching the model.
+- **Provider-agnostic from day one.** Anthropic, OpenAI, Google, Mistral,
+  Ollama, llama.cpp, plus subprocess CLIs (`claude`, `codex`, `agy`,
+  `vibe`). Mix cloud and local in the same session.
+- **Vision end-to-end.** `[Image: /path]` markers in prompts, `Ctrl+V`
+  paste in the TUI, capability-gated per arm.
+- **Single static binary.** `CGO_ENABLED=0`, multi-arch container on
+  ghcr.io. No daemon, no runtime deps.
+
+## Status
+
+Pre-1.0 (current: **v0.3.0**). Single maintainer, breaking changes
+possible. The provider, router, and engine surfaces are settling;
+config schema and TUI bindings may still shift between minor versions.
+Apache 2.0.
+
+## Table of contents
+
+- [Install](#install)
+- [Quickstart](#quickstart)
+- [Vision / image input](#vision--image-input)
+- [Providers](#providers)
+- [Config](#config)
+- [Routing defaults](#routing-defaults)
+- [SLM routing](#slm-small-language-model-routing)
+- [Session persistence](#session-persistence)
+- [Extensibility](#extensibility)
+- [Subcommands](#subcommands)
+- [Security](#security)
+- [Development](#development)
+- [About](#about)
+- [License](#license)
 
 ---
 
@@ -498,6 +542,15 @@ Architecture, conventions, and TDD workflow: [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ---
 
+## About
+
+Named after the northern pygmy-owl (*Glaucidium gnoma*); agents are called
+**elfs** (elf owl).
+
+- **Upstream:** <https://somegit.dev/Owlibou/gnoma>
+- **GitHub mirror:** <https://github.com/VikingOwl91/gnoma> (read-only;
+  PRs go to upstream Gitea)
+
 ## License
 
 Apache License 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).