Refine bootstrap responsibilities and command states

tools/security-bootstrap-console/README.md

@@ -92,6 +92,13 @@ Role, subsystem, integration, and artefact records use the same fields:
 States are `nil`, `set`, `err`, and `ok`. Role chips expose the designated
 email as hover text.
 
+Responsibility assignments are edited through the **Change responsibilities**
+foldout. Editing enables local Save/Cancel actions; Save writes only non-secret
+role metadata and Cancel restores the last loaded values. Command cards use
+`blocked`, `todo`, `redo`, and `done` to show whether an operator command is
+available, needs to be run, should be repeated after a state change, or has
+already succeeded.
+
 The UI is a guide and approval surface, not the identity provider. Current
 lightweight-mode credential placement is: