feat: bug-report collector tools/bugreport.py and instructions/bug-report.md (#157)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- VERSION
- instructions/bug-report.md
- instructions/gates.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- reports/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/tests/test_bugreport.py

instructions/gates.md

@@ -215,6 +215,14 @@ never in response to a gate refusal.** The plan is the human approval the gate w
 have to ask for; a refusal means that approval has not been given yet. If you are tempted to
 re-export the variable after an `ERROR` line, that is the gate working.
 
+**One tool takes a new id itself, for a fixed set of read commands.** `tools/bugreport.py`
+([bug-report.md](bug-report.md)) runs `instructions verify` and `docs verify` under
+`WIKITOOL_SESSION_ID=bugreport-<stamp>`, so that collecting a report neither spends the
+caller's budget nor is refused by it at exactly the moment something has gone wrong. That is
+permitted because the script sets the id for those two commands only, never in the caller's
+shell, and the set is a constant in the script. It is not a precedent for an agent: an agent that
+exports a `bugreport-*` id, or any other, outside the two cases above is opening the gate.
+
 Background: the [[Iteration and Cost Limits]] concept page in `kb/`.
 
 ## Scope