Add logshield check screenshots to the README as a proof of concept

CHANGELOG.md

@@ -13,6 +13,7 @@ follow [Semantic Versioning](https://semver.org/) from the first tagged release.
 - CISA secure-by-design mapping in `docs/assurance.md`, including why monitor mode is the default.
 
 ### Changed
+- README: screenshots of `logshield check` runs from the lab, as a proof of concept.
 - README: a plain-language "At a glance" section (what it is, who it is for, how you use it) and common questions. Roadmap: measured results next to the targets, a corrected coverage floor, and an "After 0.1" list.
 - README: v0.1.0 status, install section (container and release archive), a "What it does not do" section, governance and citation links. `docs/releasing.md` describes the signed-tag, pull-request release flow.
 - The startup message that says monitor mode does not block is now a warning, so it shows at `-log-level warn`.

README.md

@@ -226,6 +226,27 @@ payload sits, `-json` prints machine-readable output, `-` reads the payload from
 standard input, and `-disable-rule` and `-block-suspicious` mirror the proxy.
 Details: [docs/proxy.md](docs/proxy.md#explaining-a-verdict-logshield-check).
 
+#### Proof of concept
+
+Real runs of `logshield check` on a Kali Linux VM in the project's
+isolated lab. Every payload points at a reserved `.invalid` name, so nothing can
+connect anywhere.
+
+A plain JNDI lookup (exit code `4`), then the same attack hidden behind a nested
+`lower` lookup, which a search for the text `jndi` alone would miss:
+
+![logshield check on a plain and an obfuscated JNDI lookup: both malicious, rules LSH-1001 and LSH-1002](docs/images/check-plain-and-obfuscated.png)
+
+A percent-encoded payload in a query parameter. The engine decodes the layer a
+real web stack would and reports it was "revealed after decoding: percent":
+
+![logshield check on a percent-encoded payload in a query parameter: malicious, rule LSH-1002, revealed after decoding](docs/images/check-percent-encoded.png)
+
+JSON output for a script or a pipeline. A bare `env` lookup is only suspicious,
+so block mode would let it through and record it unless `-block-suspicious` is set:
+
+![logshield check -json on an env lookup: decision suspicious, would_block_in_block_mode false, rule LSH-2002](docs/images/check-json-suspicious.png)
+
 ### Options
 
 | Flag | Default | Meaning |