docs: decide GTM sequencing and privacy position

[KenTaniguchi-R]

Closes #22.

Decision

• keep the initial beachhead at non-EU, non-unionized 100–500-person engineering organizations
• lead Phase 1 with measurable senior-time recovery, not an abstract privacy claim
• preserve the no-central-corpus/no-persistent-twin distinction as the trust proof and long-term moat
• reject the broader “we do not ingest employee data” claim while the hosted relay processes plaintext and stores metadata
• require informed volunteer opt-in for the first pilot and define measurable duration, sample, value, and security thresholds
• gate regulated and EU expansion on shipped security, audit/export, retention/erasure, administration, runtime, residency, and worker-governance controls

Why

The prior research mixed up the segment that gives the fastest product learning with the segment that values the architecture most. Starting in the EU would make the first pilot test product value, regional deployment, and worker governance simultaneously. Dropping the privacy boundary would erase the structural distinction from centralized knowledge twins. The phased sequence keeps both without overclaiming current behavior.

Verification

• checked the decision against the living cloud data map, audit-retention policy, demand research, and enterprise-pivot research
• verified EU workplace/deployer, German co-determination, and Cloudflare localization constraints against primary sources
• pnpm -r build
• pnpm -r typecheck
• pnpm -r test
• independent product/research and decision-contract reviews