docs: refresh READMEs

[ColoCarletti]

No description provided.

[claude]

Review

This PR is documentation-only (all 6 changed files are README/markdown updates). No code changes.

Documentation quality looks good:

• CLI README improvements: clearer command syntax using ./target/release/cli instead of cargo run, added flag reference tables, added count-elements command docs
• New executor/README.md and prover/README.md with usage examples and API tables
• spec/README.md cleaned up and clarified
• New syscalls/README.md documenting the guest SDK API
• Root README updated with CLI quickstart and corrected file paths

One minor note: The syscalls README example has a redundant double-module path — syscalls::syscalls::get_private_input() instead of the more ergonomic syscalls::get_private_input(). Worth checking whether the public API re-exports the inner module's functions at the crate root.

No security, bug, or performance concerns.

[github-actions]

Codex Code Review

Finding: Low Security

prover/README.md shows prove + verify as the complete verifier-side pattern, but it never checks proof.public_output against an expected public claim. In a zkVM integration, verification only proves the guest executed consistently with the committed output; the caller still needs to validate that output is the statement they intended to accept. The new syscalls/README.md example also commits the entire private input back as public output, which is a risky default example for a “private input” API.

Action: update the examples to compare proof.public_output to an expected value, and avoid using “echo private input” as the primary SDK example unless it explicitly warns that committed bytes are public.

[claude]

Documentation-only PR. All API names, file paths, and feature flags were verified against the source — they're accurate.

One minor issue filed inline: the example in syscalls/README.md aliases the crate as syscalls and then calls syscalls::syscalls::get_private_input(). The double-module path is confusing; importing the inner module directly (use lambda_vm_syscalls::syscalls;) reads much cleaner.

[github-actions]

Codex Code Review

No findings.

The PR only changes documentation/README files. I did not find concrete security, correctness, significant performance, or simplicity issues in the changed diff.

[gabrielbosio]

executor/README.md and syscalls/README.md should be accessible through root README