docs: split README into overview and operator guide for release

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/milter/milter.go

@@ -27,7 +27,7 @@ import (
 
 // Store is the persistence the milter needs on the receive path: recording
 // accepted messages (architecture.md § Mail path) and, for level-2 rate
-// limiting (README § Rate limiting), looking up the configured limits and
+// limiting (guide § Rate limiting), looking up the configured limits and
 // counting recent messages. *store.Store satisfies it; tests substitute a
 // fake.
 type Store interface {
@@ -76,7 +76,7 @@ func (s *session) Connect(host, family string, port uint16, addr net.IP, m *milt
 // macros). This is also the earliest stage where both the sending domain (from
 // the sender) and the application (the login) are known, so the level-2 rate
 // limit is enforced here: over the limit, the message is refused with a 4xx
-// tempfail before recipients are even offered (README § Rate limiting).
+// tempfail before recipients are even offered (guide § Rate limiting).
 // Enforcement is fail-open — see overLimit.
 func (s *session) MailFrom(from string, m *milter.Modifier) (milter.Response, error) {
 	s.releaseReservations() // a previous transaction that ended without EOM/ABORT

internal/milter/ratelimit.go

@@ -8,7 +8,7 @@ import (
 )
 
 // overLimit reports whether the message currently being received should be
-// refused under a level-2 differentiated limit (README § Rate limiting). It
+// refused under a level-2 differentiated limit (guide § Rate limiting). It
 // checks the domain-level and application-level limits in turn; either being
 // exceeded is enough to refuse.
 //
@@ -80,7 +80,7 @@ func (s *session) releaseReservations() {
 }
 
 // recordRejected writes a send-log row for a message refused by a level-2
-// limit (README § Rate limiting — refusals are recorded too), so the rejection
+// limit (guide § Rate limiting — refusals are recorded too), so the rejection
 // shows up in the monitoring screen. Only MAIL-stage fields are known; the
 // write is best-effort and never affects the response.
 func (s *session) recordRejected() {