🖋️ [readme] note need for sudo on recent versions of MacOS

[chicks-net]

Phase 1 of #34

Done

• 🖋️ [readme] note need for sudo on recent versions of MacOS

Meta

(Automated in .just/gh-process.just.)

[claude]

Review

Docs-only PR (README, +39/-0), no code changes. Overall this is a well-written, accurate addition that matches the existing README conventions closely (the - dash separator style, the ScreenOutput fenced-code-block convention already used at line 122, MD004: dash list style, and the #macos-note-local-network-permission anchor is correctly derived from the new heading per GitHub's slug rules).

Code quality / style

• Consistent voice and formatting with the rest of the README; the anchor link in the new "Known bugs → Coming soon" bullet (#macos-note-local-network-permission) resolves correctly.
• Placement under "Known bugs → Coming soon" for issue macOS Local Network privacy permission blocks locally built ctm binary #34 is a reasonable fit since it's tracked as an external (Go toolchain) issue rather than an unimplemented feature.

Minor/security note (docs-only, low severity)

• The sudo ./ctm status ... workaround is accurate (TCC exempts root), but it's worth being a little more explicit that this means running a UDP client against untrusted/unauthenticated network responses as root — fine for the ad-hoc "poke at my own clock" case the doc describes, but worth a one-line caveat so readers don't reach for sudo as a default habit for scripts/automation. The doc already hints at this ("lousy for scripts") but doesn't tie it to the privilege angle specifically.
• Might be worth double-checking the golang/go#70530 issue link still points to the intended upstream tracking issue before merge (external links can drift/renumber), though I have no reason to doubt it here.

Bugs / performance / test coverage

• N/A — no executable code changed, so main_test.go coverage is unaffected. No functional risk from this change.

Nice, concrete addition (the codesign -dv output and the exact write: broken pipe error message make this easy for someone hitting the issue to self-diagnose). No blocking issues from my side.