docs: trim README and refresh the stale roadmap

[Zach Dunn (zachdunn)]

In plain terms

A docs-honesty pass. The README leaned contributor-heavy for a front door, docs/roadmap.md was mostly a list of things that had already shipped, and two places still claimed private-repo attachments are on guessable public URLs — which stopped being true when randomized private prefixes landed (#641).

What it does

• Rewrites docs/roadmap.md: points at VISION.md as the direction document, keeps only genuinely open items, and folds shipped work (self-serve workspaces, MCP servers, presigned URLs, retention cron, private-attachment prefixes) into one closing paragraph.
• Trims the README's "What's in this repo" table from 19 rows to 4 and replaces the docs table (which duplicated docs/README.md) with a short paragraph — adding a VISION.md link the README never had.
• Corrects the hosted-files privacy wording in README and llms.txt: files are public URLs, private-repo attachments get non-guessable links, anyone holding a URL can view the file.

What it is not

• No changes to the newcomer-facing narrative (hero, "What is this?", walkthrough, "Use it") — those read well as-is.
• No product-site docs changes; the stale claim only existed in the repo README and llms.txt.

Test plan

• Verified roadmap items against code (retention cron in apps/api/wrangler.jsonc, /console page, private-attachments doc)
• Grepped for remaining "public, including private repos" claims — none left

[changeset-bot]

⚠️ No Changeset found

Latest commit: b56e24f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3d114a2e-31c6-4592-a2c8-72fe10e2c4e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}