docs: explain hardening setting rationale

README.md

@@ -8,7 +8,7 @@ Five HKLM registry settings: disable AutoRun and AutoPlay (including non-volume
 ## Implementation
 - `setup.py` now contains the complete install, audit and conditional rollback logic.
 - Registry reads and writes use WAPT 2.6 `setuphelpers` (`reg_key_exists`, `reg_value_exists`, `reg_openkey_noredir`, `reg_getvalue`, `registry_set`, and `reg_delvalue`). No PowerShell process or external command is launched.
-- The approved setting table is centralized in `SETTINGS`. A future `update_package.py` can validate operator-selected settings and serialize them as package data; this refactor keeps the current five-setting policy fixed.
+- The approved setting table is centralized in `SETTINGS`. Each dictionary documents `Path`, `Name`, `Value`, `Purpose` and `Rationale`, so maintainers can see both the exact registry operation and why the policy is included. A future `update_package.py` can validate operator-selected settings and serialize them as package data; the current five-setting policy remains fixed.
 - If a future package configuration changes a setting’s target, its update flow must migrate the saved uninstall target while preserving the original pre-install value. That migration is not part of this refactor.
 - The WAPT package source currently has no `WAPT/control` or `update_package.py`; it is code-only and is not yet a complete buildable WAPT package.