Remove a false key-storage claim; fix a broken CLI example and a stale artifact table

Three defects in the README, all found while cross-checking it against the
source and the published releases.

## 1. The key-storage claim was false, not merely wrong about platforms

"Private keys are stored in the OS secure enclave on every platform (iOS
Keychain, macOS Keychain, Android Keystore). They are never written to disk
in plaintext."

There is no OS-keychain integration in Konduit at all. Nothing in the Rust
workspace or the Flutter GUI references a keyring or secure-storage crate --
the GUI's only persistence dependency is shared_preferences. And
core/src/config.rs writes the client identity key straight into the config
file the docs tell you to pass with --config:

    client.toml:  identity_key = "<hex>"

so "never written to disk in plaintext" was false by construction, for the
one thing the claim was about. It also named two platforms that do not ship.

Replaced with what actually happens, and the consequence: the key is
generated locally, never sent to K-Ops, and the config file is itself the
secret -- so restrict its permissions, do not commit it, do not paste it
into a bug report. Deliberately not reworded into another claim I could not
verify.

## 2. The CLI example does not run

    ./konduit connect --config client.toml

--config is a top-level flag on Args (cli/src/main.rs:15), not on the
Connect subcommand, and it is not marked global, so clap rejects it:

    error: unexpected argument '--config' found

Fixed to `./konduit --config client.toml`, which is the form
docs/client-quickstart.md uses and the binary accepts. Documented the
`connect` subcommand's actual flags --server/--peer-id/--identity/
--server-pub -- checked against `konduit connect --help`.

## 3. The artifact table lists assets that are not in the current release

Checked against the Gitea releases API rather than the Makefile. v0.1.0-beta.11
ships five assets: the AppImage, the three Linux binaries, and
konduit-gui-...-windows-x86_64-portable.zip. It has no Windows CLI zip and
no Android AAB; beta.9 and beta.10 had both, and the Windows GUI zip was
only named -portable.zip in beta.11.

So the Windows GUI row is now the published name, and the two rows that
appear in some releases but not others are marked as such with the
variation spelled out. The Releases page is called authoritative, since
which assets ship is a per-release decision.

No claim here is reworded from assumption -- each one was checked against
the code or the published release first.

README.md

@@ -48,9 +48,14 @@ Releases are published on the [Releases](../../releases) page. Each release incl
 | `konduit-*-linux-x86_64` | Linux | CLI client |
 | `konduit-ctl-*-linux-x86_64` | Linux | Server provisioning tool |
 | `Konduit-*-x86_64.AppImage` | Linux | GUI client (AppImage) |
-| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll |
+| `konduit-gui-*-windows-x86_64-portable.zip` | Windows | GUI client |
-| `konduit-gui-*-windows-x86_64.zip` | Windows | GUI client |
+| `konduit-cli-*-windows-x86_64.zip` | Windows | CLI client + wintun.dll — **not in every release** |
-| `konduit-*-android.aab` | Android | Android app (sideload via bundletool) |
+| `konduit-*-android.aab` | Android | Android app for bundletool sideload — **not in every release** |
+
+Which Windows and Android assets are attached varies between releases: v0.1.0-beta.9
+and v0.1.0-beta.10 carried both, v0.1.0-beta.11 shipped the Windows GUI zip only (as
+`-portable.zip`). **The [Releases](../../releases) page is authoritative** — check it
+rather than assuming a row is present. Android is on Google Play either way.
 
 ### Linux (CLI)
 
@@ -62,7 +67,15 @@ chmod +x konduit konduit-ctl
 echo "your secret mantra" | ./konduit-ctl bootstrap -l vpn.example.com:443 -p -
 
 # Connect a client
-./konduit connect --config client.toml
+./konduit --config client.toml
+```
+
+`--config`/`-c` is a top-level flag, not a `connect` flag. The `connect`
+subcommand takes the peer details individually instead:
+
+```bash
+./konduit connect --server vpn.example.com:443 \
+  --peer-id <peer-id> --identity <key-hex> --server-pub <server-pub-hex>
 ```
 
 ### Linux (GUI)
@@ -131,7 +144,7 @@ The VPN server and management UI are proprietary. Source review under NDA is ava
 
 **No UDP dependency:** Konduit does not require UDP at any layer.
 
-**Key storage:** Private keys are stored in the OS secure enclave on every platform (iOS Keychain, macOS Keychain, Android Keystore). They are never written to disk in plaintext.
+**Key handling:** Your private identity key is generated locally by `konduit-ctl` and written into the client configuration file you pass with `--config` — it is never transmitted to K-Ops, and K-Ops operates no server. **That file is the secret.** Treat it like a private key file: readable only by its owner, and the only thing standing between an attacker and a tunnel into your VPN is its permissions. Do not commit it or paste it into a bug report.
 
 ## Support