stack: Telemetrie-Default nach Installationsform, Byte-Deckel und Session-Retention (schliesst #55)

Files changed:
- .gitea/workflows/ci.yml
- .gitignore
- CHANGES.md
- EVALS.md
- INSTALL-MCP.md
- INSTALL.md
- VERSION
- instructions/setup-instance.md
- reports/CONTRACT.md
- tools/CONTRACT.md
- tools/chemenu/commands/doctor.py
- tools/chemenu/config.py
- tools/chemenu/mcp/server.py
- tools/chemenu/telemetry/policy.py
- tools/chemenu/telemetry/schema.py
- tools/chemenu/telemetry/writer.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_mcp_server.py
- tools/chemenu/tests/test_telemetry_emit.py
- tools/chemenu/tests/test_telemetry_policy.py
- tools/chemenu/version.py

reports/CONTRACT.md

@@ -33,11 +33,21 @@ prompts and assistant replies in cleartext and belongs to the machine it ran on,
 repository. What a trace concludes - a scored eval, a failure taxonomy - is carried out the
 same way a lint report's judgment is: into `kb/`, `work/`, or `kb/log.md`.
 
-`WIKI_TRACE_DIR` redirects the tree; `WIKI_TRACE=0` turns recording off; `WIKI_TRACE_CONTENT=0`
-keeps lengths and digests instead of text.
+`WIKI_TRACE_DIR` redirects the tree; `WIKI_TRACE` turns recording on or off, overriding both the
+installation-form default (on for a dev checkout, off for a distributed instance -
+`chemenu.telemetry.policy`) and a per-checkout `.wikitool-telemetry.json`; `WIKI_TRACE_CONTENT=0`
+keeps lengths and digests instead of text. See [../EVALS.md](../EVALS.md) § "Whether it runs at
+all" for the full precedence and both quantity caps below.
 
 ## Retention
 
-None. Old reports are local scratch; delete them freely. There is nothing to retire with
-`wikitool rm`, because no report is ever a wiki page - `lint-report` is a contract-only
-type-spec with no `base_dir:` and cannot be instantiated under `kb/`.
+**Lint reports: none.** Old ones are local scratch; delete them freely. There is nothing to
+retire with `wikitool rm`, because no report is ever a wiki page - `lint-report` is a
+contract-only type-spec with no `base_dir:` and cannot be instantiated under `kb/`.
+
+**Traces: two enforced caps, applied by the writer itself, never by a separate cleanup pass.**
+A byte cap per session trace (default 5 MiB, `WIKI_TRACE_MAX_SESSION_BYTES`) and a retention
+limit on the number of session directories under `reports/telemetry/` (default 250,
+`WIKI_TRACE_KEEP_SESSIONS`), both fail-silent like the writer itself. Neither ever removes a
+session directory in bulk - only the `trace.jsonl`/`.limit` files a cap's own rule names, and
+only once the directory is otherwise empty.