Adopt OCSentinel script layout and add Gitea workflow

README.md

@@ -0,0 +1,38 @@
+# OfficeCom Sentinel
+
+OfficeCom Sentinel is the hardened endpoint client for Windows event correlation, NinjaOne field updates, CVE correlation, and optional n8n upload.
+
+## Main Paths
+
+- CLI source: `src/AttackTracerNinjaCli`
+- local runner: `scripts/run-ocsentinel.ps1`
+- Ninja monitor wrapper: `scripts/run-ocsentinel-monitor.ps1`
+- packaged installer runtime: `installer/runtime-run-ocsentinel.ps1`
+- package builder: `build/build-client-package.ps1`
+- update manifest builder: `build/build-release-manifest.ps1`
+
+## Build
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\build\build-client-package.ps1
+```
+
+This creates:
+
+- `artifacts/OCSentinelClient-win-x64.zip`
+- `artifacts/OCSentinelClient-win-x64.zip.sha256`
+
+## Release Manifest
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\build\build-release-manifest.ps1 `
+  -ArtifactUrl "https://gitea.officecom.cloud/officecom/oc-sentinel/releases/download/v2.0.0/OCSentinelClient-win-x64.zip"
+```
+
+This creates:
+
+- `artifacts/version.json`
+
+## Compatibility
+
+Legacy `attacktracer` script names are still present as wrappers so existing NinjaOne jobs do not break immediately. New work should use the `ocsentinel` script names.