feat(core): add validated configuration and CLI foundation

README.md

@@ -1,2 +1,21 @@
 # wireguard-scripts
 
+## M1 runtime foundation
+
+The current entry point provides dependency-free `help` and `version` commands. The
+planned operational commands are recognized but remain unavailable until later
+milestones.
+
+Runtime locations default to the project directory and can be redirected for an
+isolated run with absolute paths using these environment variables:
+
+`WG_MANAGER_CONFIG`, `WG_MANAGER_BACKUP_DIR`, `WG_MANAGER_LOG_DIR`,
+`WG_MANAGER_METADATA_DIR`, `WG_MANAGER_ARCHIVE_DIR`, and `WG_MANAGER_LOCK_FILE`.
+
+`WG_MANAGER_GUM` selects an executable `gum` explicitly; otherwise the bundled
+`bin/gum` and then `PATH` are checked in that order. Configuration is parsed as
+restricted `KEY=VALUE` data and is never executed as shell code. Blank lines and
+full-line `#` comments are ignored; spaces around the key, `=`, and value are
+trimmed. Values are either one unquoted token or a double-quoted value without
+escapes, and only documented keys are accepted.
+