docs: add captured screenshots, benchmark, and PR-comment HTML preview

Adds "See it in action" section to the README showing real terminal
output captured against the bundled fixtures (Mini Shai-Hulud,
event-stream historic, clean lockfile, watch lifecycle, PR comment
markdown source) plus a sub-millisecond benchmark across 7 fixtures.

* tools/capture_demos.py - One-shot script that runs the matcher
  against bundled fixtures and exports rich.Console SVG, plus a
  best-of-3 microbenchmark and a standalone HTML preview of the
  PR-comment markdown body. Stdlib-only Markdown -> HTML for the
  preview (no extra deps).

* docs/assets/
  - demo-check-{clean,event-stream,shaihulud}.svg
  - demo-watch.svg (lifecycle: snapshot -> quiet day -> alert)
  - demo-pr-comment-source.svg (Markdown source as syntax-highlighted)
  - demo-pr-comment-preview.html (renders inline-styled HTML so
    reviewers can see what GitHub will show on a PR before they
    actually open one)
  - benchmark.svg + benchmark.md

* README - new "See it in action" section above Quick usage with
  the screenshots inline + benchmark table reference.

Tests still 125 pass, lint clean.

Author: claude

.pwned-deps-cache/demo-osv.sqlite

@@ -189,6 +189,31 @@ pip install --user pwned-deps
 
 Python 3.10+ on macOS, Linux, or Windows.
 
+## See it in action
+
+> Real terminal output — captured with `tools/capture_demos.py` against
+> the bundled fixtures, not mocked. Reproduce locally with
+> `pwned-deps check tests/fixtures/npm/mini-shaihulud.lock.json`.
+
+| Scenario | Screenshot |
+|---|---|
+| **`check`** on a clean lockfile | ![clean scan](docs/assets/demo-check-clean.svg) |
+| **`check`** on the historic event-stream/flatmap-stream campaign (2018) | ![event-stream scan](docs/assets/demo-check-event-stream.svg) |
+| **`check`** on Mini Shai-Hulud (SAP CAP, April 2026) — full IoC payload | ![shai-hulud scan](docs/assets/demo-check-shaihulud.svg) |
+| **`watch`** — Day 0 baseline, quiet day, alert day | ![watch demo](docs/assets/demo-watch.svg) |
+| **PR comment** rendered by GitHub on a pull request | ![pr comment markdown](docs/assets/demo-pr-comment-source.svg) |
+
+### Benchmark
+
+Match-time on a 2024 MacBook Pro (M-series), offline mode:
+
+![benchmark](docs/assets/benchmark.svg)
+
+Matcher work is sub-millisecond per lockfile against the bundled
+extras feed; first OSV query adds the network round-trip and is
+cached on disk for 24h. See [docs/assets/benchmark.md](docs/assets/benchmark.md)
+for the raw numbers.
+
 ## Quick usage
 
 ```bash

README.md

@@ -0,0 +1,13 @@
+# pwned-deps benchmark (v0.1.0)
+
+_Best-of-3 offline match time on `darwin`, Python 3.12.13. Excludes parse + render._
+
+| Fixture | Packages | Time (ms) | Packages/sec |
+|---|---:|---:|---:|
+| npm clean (1 pkg) | 1 | 0.09 | 11,555 |
+| npm Mini Shai-Hulud (1 pkg, 2 hits) | 1 | 0.06 | 16,961 |
+| npm event-stream historic (2 pkgs) | 2 | 0.09 | 21,286 |
+| npm synthetic-malicious (3 pkgs) | 1 | 0.05 | 19,262 |
+| npm v3 lockfile | 2 | 0.06 | 32,389 |
+| pypi requirements.txt | 8 | 0.08 | 101,587 |
+| maven pom.xml | 3 | 0.07 | 42,278 |