feat: bug-report collector pseudonymises identities in two stages, opt-in via --pseudonymise (#158)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- VERSION
- instructions/bug-report.md
- reports/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/tests/test_bugreport.py

tools/README.md

@@ -64,7 +64,11 @@ tools/
 from it: it is the bug-report collector ([../instructions/bug-report.md](../instructions/bug-report.md)),
 and the case it exists for is a checkout where `wikitool` does not start. It therefore uses the
 standard library only, keeps to Python 3.8 syntax so that an old interpreter can still run it, and
-exits 0 or 1 - never 42, since it opens no gate. `dist export` ships it with the rest of `tools/`;
+exits 0 or 1 - never 42, since it opens no gate. It has a second mode: `--pseudonymise` replaces the
+identities it can read from the machine (stage 1), and `--bundle`/`--candidates` applies names a
+model found in the result (stage 2), both word by word so that length, separators and depth
+survive. The mapping, the review list and the candidate file stay beside the bundle directory.
+`dist export` ships it with the rest of `tools/`;
 its tests (`tests/test_bugreport.py`) run it on a bare interpreter (`-I -S`) to keep that promise.
 
 **Two consumers, one core.** The CLI is not the only caller any more. The cores