receipt --check --hash-only, and agent.md fixes from the second dogfood run

A second fresh sub-agent with only agent.md audited fastapi/typer, read the public run log and checked a site receipt. It succeeded, and these fix what it had to guess.

• firstrun receipt --check --hash-only checks the receipt hash alone, so a receipt fetched from the site passes without its run files.
• agent.md: site receipts use --hash-only in an empty folder, audit output goes to audit-result.json, fixture rows and the running status are named, and an empty FIRSTRUN_ENV_FILE gives a run with no keys.