docs(miner-discovery-plane): write the hosted-plane opt-in/opt-out operator guide

[JSONbored]

Depends on the discovery-plane contract/telemetry/soft-claim issues (Phase 6 items above) existing in some real form to document accurately — filing now as a placeholder-scoped issue per the tracker's own XS sizing, since the shape of what's being documented is already reasonably clear from #4250 and the sibling contract issue even before code lands, but the concrete env vars/flags this guide references will depend on what those issues actually ship.

Two existing precedents matter here, and they point in different directions on purpose — worth calling out explicitly so this guide doesn't accidentally copy the wrong default posture. src/selfhost/orb-collector.ts documents Orb (review-stack telemetry) as opt-out only: "Export is ALWAYS ON once the GitHub App is configured... there is no opt-out flag" (orb-collector.ts:6-7, aside from the air-gap escape hatch, ORB_AIR_GAP=true). The Phase 6 discovery plane is explicitly the opposite posture — #4250 itself calls it "optional," and the roadmap's hybrid, self-host-first deployment model treats a miner's participation in any hosted plane as something the operator turns on, not something that's on by default and must be turned off. This guide needs to get that distinction right rather than reusing Orb's wording.

packages/gittensory-miner/DEPLOYMENT.md's existing "Invariants" section (a short, concrete bullet list of guarantees) is the right tone/format precedent for this doc's own guarantees section (what the plane does and does not send, per the sibling telemetry-schema issue's "never included" list).

Deliverables

• packages/gittensory-miner/docs/discovery-plane-operator-guide.md (or fold into DEPLOYMENT.md if it stays short enough — match whichever the sibling contract/telemetry docs end up choosing).
• Document the opt-in mechanism (env var or config flag — name TBD by whichever sibling issue introduces it) and state plainly that the default is participation OFF, contrasting explicitly with Orb's opt-out-only posture so operators don't assume the two work the same way.
• An "Invariants"-style bullet list (mirroring DEPLOYMENT.md's existing section) stating what never leaves the instance, sourced from the anonymized-telemetry-schema issue's "never included" inventory once that lands.
• Note explicitly that this is a placeholder-scoped doc until the contract/telemetry/soft-claim issues ship — link back to them so a reader lands on the concrete mechanism, not just this guide's prose.

References

• feat(discovery-plane): stand up the hosted discovery-index server #4250 (feat(discovery-plane): stand up the hosted discovery-index server) — calls the plane "optional" and lists an "operating doc" as one of its own deliverables; this guide is the client/operator-facing half of that.
• src/selfhost/orb-collector.ts:1-18 — the contrasting opt-out-only precedent (Orb) this guide must not accidentally mirror.
• packages/gittensory-miner/DEPLOYMENT.md ("Invariants" section) — tone/format precedent.
• Sibling Phase 6 issues: define the public-data-only discovery-index API contract, add anonymized telemetry event schema for the optional hosted plane, add client-side soft-claim coordination request builder — soft dependencies this doc describes.

[linear-code]

JSO-3296