feat: bug-report collector tools/bugreport.py and instructions/bug-report.md (#157)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- VERSION
- instructions/bug-report.md
- instructions/gates.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- reports/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/tests/test_bugreport.py

reports/CONTRACT.md

@@ -1,12 +1,14 @@
 # reports/ - Generated Output
 
-Derived output that must stay out of git. Two kinds live here:
+Derived output that must stay out of git. Three kinds live here:
 
 - **Lint reports**, written by `tools/wikitool lint --markdown "reports/Lint Report
   <YYYY-MM-DD>.md"`.
 - **Traces**, under `reports/telemetry/<session>/trace.jsonl` - the append-only record of
   what a session did, written by `wikitool` itself and by the harness hooks. See
   [../EVALS.md](../EVALS.md) for the event contract and what is redacted.
+- **Bug-report bundles**, under `reports/bugreport-<UTC stamp>/` and a zip beside each, written by
+  `tools/bugreport.py` on request - see [../instructions/bug-report.md](../instructions/bug-report.md).
 
 **Everything in this directory except this file is gitignored.** A lint report is a derived
 copy of recomputable truth: its structural sections can be regenerated from the tree at any
@@ -39,12 +41,27 @@ installation-form default (on for a dev checkout, off for a distributed instance
 keeps lengths and digests instead of text. See [../EVALS.md](../EVALS.md) § "Whether it runs at
 all" for the full precedence and both quantity caps below.
 
+## Bug-report bundles
+
+A bundle is a snapshot of one machine at one moment, made so that someone else can read what
+happened here. It is not recomputable and not durable, and it **contains private data**: machine,
+user and path names, `PATH` entries, git remotes and commit subjects, and - when included - the
+session trace, the chronology and transcripts, which may hold page content and titles. Secrets are
+removed by the collector; the rest is the reader's to check before a bundle leaves the machine.
+Nothing uploads it: the channel is the user's choice.
+
+The collector's own `wikitool` calls run under the session id `bugreport-<stamp>`, so a
+`reports/telemetry/bugreport-*` directory is that run's trace and belongs to no session of yours.
+
 ## Retention
 
 **Lint reports: none.** Old ones are local scratch; delete them freely. There is nothing to
 retire with `wikitool rm`, because no report is ever a wiki page - `lint-report` is a
 contract-only type-spec with no `base_dir:` and cannot be instantiated under `kb/`.
 
+**Bug-report bundles: none.** Delete them freely once they have been read or sent; nothing refers
+to one afterwards.
+
 **Traces: two enforced caps, applied by the writer itself, never by a separate cleanup pass.**
 A byte cap per session trace (default 5 MiB, `WIKI_TRACE_MAX_SESSION_BYTES`) and a retention
 limit on the number of session directories under `reports/telemetry/` (default 250,