Document tongs setup in the README

[CrypticSwarm]

Summary

Document how to set up and use a tong, end to end, in the README.

What this adds

A new ## Tongs (sidecar processes) section covering:

• Quick start -- the drop-a-YAML-file, run-the-anvil, approve flow.
• Where definitions live -- the four discovery layers, name-based merge, and
  disable.
• Definition format -- an annotated example plus the four interface kinds
  (mcp / port / volume / none), readiness modes, and the workspace /
  docker-socket mount magic words.
• Lifecycle -- session vs shared semantics, config-hash reuse, and how to
  force a restart.
• Secret providers -- setting up ~/.swarmforge/secret-providers.yaml, the
  ${secret:provider:ref} reference syntax, and the leak-resistant FIFO delivery.
• First-run approval -- the workspace trust gate and fail-closed behavior.