docs(signer): document configuration, semantics, and known limitations

Includes an opt-in testnet round-trip test (keyless build -> decode -> policy
-> sign, never submits), excluded from CI because it needs a funded wallet.
Run against the real funded testnet wallet: pass 3, fail 0, nothing submitted.

Verified every README claim against the code as implemented, not just the
brief text, and corrected several:
- VECTOR_SIGNER_AUDIT_LOG_PATH's default resolves against the package's own
  install location (repo root), not the process's cwd as originally stated --
  and that default filename is not yet covered by .gitignore.
- An audit-log write failure blocks ALL signing, not just accounting:
  audit.append() throws by design and vector_signer_sign withholds an
  already-produced signature rather than release one with no durable record.
- Documented the #private-field defense against accidental key leakage via
  JSON.stringify/console.log, and the read-only/sign tool split that keeps
  the signing key out of scope for get_address/decode/get_spend_limits.
- Documented that pairing this signer with the CURRENT hosted builder does
  not yet remove the custody exposure it's designed to fix: no builder tool
  is keyless yet, and there is no submit_transaction tool to hand a produced
  signature to. That's the next stage of the migration, not shipped here.

Env-var cross-check (brief's Step 6, both directions) passes clean.

README.md

@@ -30,6 +30,21 @@ claude mcp add --transport sse vector-mcp https://mcp.vector.mainnet.apexfusion.
 
 Self-hosting instructions are below.
 
+## Local signer (non-custodial path)
+
+`packages/signer` is a local MCP server that holds your key and signs transactions locally
+instead of handing your mnemonic to a shared host. It has **no network access at all** —
+stdio transport, no Provider, no egress — so a key given to it never reaches a shared server
+or your model provider.
+
+See [`packages/signer/README.md`](packages/signer/README.md) for configuration, its tools, and
+known limitations — including the gap that matters most right now: the hosted builder's tools
+above still require your mnemonic as a call parameter, so pairing the signer with *this*
+hosted builder does not yet remove the custody exposure described above. Closing that gap is
+the next stage of the migration described in
+[`docs/architecture/non-custodial-split.md`](docs/architecture/non-custodial-split.md); until
+it ships, the security notice above still applies.
+
 ## Features
 
 - **Wallet management** - derive addresses from mnemonic, query balances and UTxOs
@@ -194,6 +209,24 @@ npm run test:integration
 
 Requires `mnemonic.txt` in `packages/builder/` containing a **funded Vector testnet** mnemonic. Covers the core tools end-to-end against Vector testnet, including the full agent lifecycle: register, discover, profile, update, transfer, message, and deregister. Never runs in CI.
 
+```bash
+npm run test:smoke:signer
+```
+
+Builds the local signer (`packages/signer`), boots it over stdio, and exercises all four of
+its tools, including the fail-closed audit-write-failure path. No wallet, no network. CI runs
+this on every PR alongside the two smoke tests above.
+
+```bash
+export VECTOR_SIGNER_MNEMONIC_FILE=/absolute/path/to/testnet-mnemonic.txt
+npm run test:integration:signer
+```
+
+Requires a **funded Vector testnet** wallet. Builds a real unsigned transaction the way the
+hosted builder does (no key), then has the local signer decode, policy-check, and sign it
+against live chain data. **Never submits.** Never runs in CI. See
+[`packages/signer/README.md`](packages/signer/README.md#testing).
+
 ## Architecture
 
 ```