docs: setup.md as a short all-local checklist; bao internals move to swarm/bao.md

docs/README.md

@@ -11,8 +11,8 @@ declarations.
 
 ## Getting started
 
-- **Bringing a fresh hive online?** → [`getting-started/setup.md`](getting-started/setup.md)
-  (first-run `hivectl` bootstrap).
+- **Bringing a fresh swarm online?** → [`getting-started/setup.md`](getting-started/setup.md)
+  (the hand steps after the first switch).
 - **What does the dashboard look like, and how do I use it?** →
   [`web-ui/`](web-ui/README.md) — the operator-facing starting point;
   its own sub-pages ([`shape`](web-ui/shape.md),
@@ -80,6 +80,8 @@ declarations.
   where's that shape headed?** → [`swarm/credentials.md`](swarm/credentials.md)
   (current state, target state, and the progressive-enhancement rule);
   [`swarm/secrets.md`](swarm/secrets.md) for where each file lives today.
+- **How does the secret store come up, who writes its grants, how is it
+  sealed?** → [`swarm/bao.md`](swarm/bao.md).
 
 ## Scheduler, CI, observability