docs: add quick start, troubleshooting, and env var table to README

README.md

@@ -4,8 +4,19 @@ A [`nono`](https://github.com/guybedford/nono) sandbox profile for running
 [OpenCode](https://opencode.ai) with access to [Tinfoil](https://tinfoil.sh)
 enclaves and other LLM providers.
  
+## Quick Start
+ 
+```bash
+git clone https://github.com/autonomic/nono-opencode-tinfoil.git
+cd nono-opencode-tinfoil
+make install
+# Ensure ~/.local/bin is in your PATH
+opencode
+```
+ 
 ## Install
 
+
 ### macOS / Linux
 
 ```bash
@@ -205,8 +216,16 @@ and grants read/write access to `~/.tinfoil` for Tinfoil credentials.
 - SSH private keys, AWS/GCP/Azure credentials, kubeconfig: denied
 - `sudo`, `su`, `doas`, `passwd`, disk tools: denied
  
+### Environment Variables
+ 
+| Status | Variables / Patterns |
+|--------|----------------------|
+| Allowed | `PATH`, `HOME`, `USER`, `SHELL`, `TERM` |
+| Denied  | `AWS_*`, `GOOGLE_*`, `AZURE_*`, `KUBECONFIG`, `SSH_AUTH_SOCK` |
+ 
 ## Uninstall
 
+
 ```bash
 make uninstall
 ```
@@ -220,3 +239,12 @@ rm -f ~/.local/bin/nono-tui
 ## License
  
 GPL-3.0
+
+## Troubleshooting
+ 
+**"command not found: opencode"**
+Ensure `~/.local/bin` is in your `PATH`. Add `export PATH="$HOME/.local/bin:$PATH"` to your `.bashrc` or `.zshrc` and restart your terminal.
+ 
+**Sandbox is being bypassed**
+If you have another version of `opencode` installed (e.g. via Homebrew) that appears earlier in your `PATH` than the wrapper, the sandbox will be bypassed. Check this using `which -a opencode`. The wrapper at `~/.local/bin/opencode` must come first.
+