feat: add safe BLE discovery and network baseline tools

README.md

@@ -50,6 +50,20 @@ uv run pytest
 and reports external tools; it does not request Bluetooth permission, scan the
 LAN, touch the K1, alter Homebrew, or change capture permissions.
 
+The currently implemented laboratory commands are:
+
+```bash
+uv run k1link ble scan --duration 30 --out sessions/<id>/captures/ble.json
+uv run k1link ble gatt-dump --device <corebluetooth-uuid> \
+  --out sessions/<id>/captures/gatt.json
+uv run k1link net snapshot --out sessions/<id>/captures/network.json
+```
+
+On macOS the scan is active CoreBluetooth discovery, but it does not connect to
+or modify devices. `gatt-dump` connects and performs service discovery only; it
+does not read characteristic values, subscribe to notifications or write
+configuration. Session output is sensitive and ignored by Git.
+
 ## Documentation
 
 - [Technical audit](docs/00_TECHNICAL_AUDIT.md)
@@ -65,7 +79,7 @@ provenance remains clear.
 
 ## Safety boundary
 
-Allowed initial work is passive discovery, standard device-information reads,
+Allowed initial work is non-mutating discovery, standard device-information reads,
 controlled notification listening, autonomous button operation, targeted
 capture of traffic to or from the confirmed K1 address, and offline analysis of
 owned artifacts.