Place the DCO text, and record the data locality position

[iderex]

The issue this belongs to

Closes #68

Part of #106, which stays open. Its condition is not met and the reason is under
"What this does not cover".

Two issues in one pull request. Both land documents and both add a file the other
does not touch, and one of them adds a line to docs/decisions/README.md, which
every record issue also adds a line to. Landed separately, the second rebases the
index for no reason but the order they went in.

What changed

DCO at the root carries the Developer Certificate of Origin version 1.1 as
published, with nothing added and nothing removed. The sign-off check has been
refusing commits against it since it landed, and telling contributors to read a
file that was not there.

docs/decisions/0068-the-data-locality-position.md records the position:
personal data stays on the operator's own host and on the devices they use, the
core opens no connection to a host the operator did not configure, there is no
diagnostics or statistics route out of a device at all, and reaching a second
server is an act rather than a default.

It lists what counts as personal data concretely and gives the one question a
contributor asks about a field the list does not name. It states the rule in the
shape a check can refuse and names #70 and #73 as the mechanisms, saying plainly
that until those exist nothing refuses a violation. It states what is kept on the
device, for how long, and what removes it, and it refuses to promise anything
about what an uninstall leaves, because the core does not choose where the
client's stores put their bytes. It names the three things the position gives up.

What failure it prevents

A contributor whose first pull request is refused by the sign-off check is sent
to ./DCO to read what they are being asked to certify, and there is nothing
there. That is the first experience this repository offers anybody, and it reads
as a broken repository rather than as a rule.

A data locality position adopted after code exists has to be proven against code
that was not built for it, and that proof is an audit rather than a check. The
direction is also one-way: removing a route out of a device is easy while nothing
depends on it and impossible once a dashboard does.

The specific failure the record is against is optional telemetry in a library
that eleven clients link. The choice then sits with each client author, an
operator cannot tell which of them enabled it, and the person whose viewing
history it is has a relationship with none of them.

Evidence

The DCO text was taken from the publisher rather than written, and the blob on
the pushed branch is byte for byte what that source serves:

$ curl -sS https://developercertificate.org/ | tr -d '\r' \
    | sed -n '/^<pre>/,/^<\/pre>/{ /^<\/pre>/d; s/^<pre>//; p }' \
    | diff - <(git cat-file -p origin/docs/data-locality-and-dco:DCO)
(no output)

No output from diff is the whole claim. Nothing was reformatted, rewrapped or
retyped.

$ git diff --stat origin/main...origin/docs/data-locality-and-dco
 DCO                                               |  34 ++++
 docs/decisions/0068-the-data-locality-position.md | 216 ++++++++++++++++++++++
 docs/decisions/README.md                          |   1 +
 3 files changed, 251 insertions(+)

$ git log --format="%h %G? %s" origin/main..origin/docs/data-locality-and-dco
ad33875 G Record the data locality position, and what it gives up
1d01188 G Place the DCO text every commit here already certifies

G is a good signature on both.

The index lists every record in the tree, and every record in the tree is listed:

$ git ls-tree --name-only origin/docs/data-locality-and-dco docs/decisions/
docs/decisions/0001-decision-records.md
docs/decisions/0003-what-the-core-does-not-do.md
docs/decisions/0004-the-error-vocabulary.md
docs/decisions/0005-the-session-model.md
docs/decisions/0006-the-cache-contract.md
docs/decisions/0007-a-slow-server-and-a-server-that-is-gone.md
docs/decisions/0008-what-the-core-can-measure-of-the-speed-budget.md
docs/decisions/0009-the-concurrency-model.md
docs/decisions/0068-the-data-locality-position.md
docs/decisions/0102-the-clocks-every-deadline-is-measured-against.md
docs/decisions/0112-where-the-platform-decoder-begins.md
docs/decisions/README.md

$ git grep -c '](0' origin/docs/data-locality-and-dco -- docs/decisions/README.md
origin/docs/data-locality-and-dco:docs/decisions/README.md:12

Twelve matching lines against eleven records, because 0001 is linked once from
the sentence above the list and once from the list itself.

What a guard here refuses, and the proof it bites

No guard is added or edited here. DCO is the text a guard that already exists
refers to, and placing it changes nothing about what that guard refuses.

The refusal was not exercised on this branch. Doing so would mean pushing a
commit with no sign-off, watching the check go red, and then removing it, and
removing a pushed commit means a force-push. So the direction of that guard is
not demonstrated here, and this pull request makes no claim about it beyond the
five green checks on its own commits.

What this does not cover

#106 is not closed. Its condition asks that the message the check prints on
refusal names files that now exist. That message names two, CONTRIBUTING.md and
./DCO. Only the second lands here. CONTRIBUTING.md is #23, and the sentence
telling a contributor how to satisfy the sign-off goes in whichever file #23
decides, which is why the issue holds itself blocked on #23 for the sentence and
not for the file.

The refusal message in .github/workflows/dco.yml is not edited to drop the
reference. It would satisfy the condition today and would have to be put back
when #23 lands, and it is a guard this change has no other reason to touch.

0001's listing of docs/decisions/ was pasted at the commit that introduced it
and now under-lists the directory by one. It is a pasted command output anchored
to its own change rather than an inventory, and the record is not edited to
refresh it, because refreshing a paste is not one of the three edits 0001
allows on a landed record. docs/decisions/README.md is the thing that is kept
current, and the listing above is what the directory holds at this commit.

Nothing in 0068 is enforced. #70 and #73 are the mechanisms it names and both
are open, so the position is prose today and the record says so where it states
the rule.

No number in 0068 is a measurement, because it contains none.

Nothing was built, run or tested, because there is nothing in this repository to
build.

Who has read it

Nobody other than the author has read this change. There is no second reader on
it, and the evidence above stands in place of one rather than the question being
left open.