requestlog: publish collector-readable evidence boundary

Publish the reviewed Gamertan Web Foundations v0.1.0-preview.6 snapshot with a narrow mode-0640 collector boundary, private mode-0600 default, explicit setgid ownership guidance, and native macOS-safe release verification.

Exported from reviewed private source 120d660fa432761f85316ca3dde990e2dd142f19 after trusted Gitea CI run 681 and the complete native Mac verification suite.

Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/GETTING_STARTED.md

@@ -25,7 +25,7 @@ The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.5
+go get gamertan.com/web/requestmeta@v0.1.0-preview.6
 go mod verify
 ```
 
@@ -45,6 +45,14 @@ handler = resolver.Middleware(handler)
 The complete, copyable composition is in [`starters/basic`](../starters/basic).
 It binds to loopback, shuts down gracefully, and keeps request logging optional.
 
+`requestlog.OpenJSONL` creates a private mode-`0600` file. If a separate,
+unprivileged collector such as Observatory is the only approved reader, prepare
+a trusted setgid directory whose group is that collector, then opt into
+`requestlog.OpenJSONLWithOptions(path, requestlog.JSONLOptions{FileMode: 0o640})`.
+The application still owns rotation, retention, disk monitoring, and sink-error
+health. Never use a world-readable log or add the collector to the application
+account's broader groups merely to make collection convenient.
+
 Configure trusted proxy networks narrowly. A forwarding header is not evidence
 by itself; it becomes usable only when the immediate peer and skipped proxy
 hops satisfy the resolver's trust policy. Metadata, authentication, or storage

docs/MODULES.md

@@ -18,7 +18,7 @@ import "gamertan.com/web/requestmeta"
 and request the containing module at an exact version:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.5
+go get gamertan.com/web/requestmeta@v0.1.0-preview.6
 ```
 
 Only imported packages are compiled and linked. The packages nevertheless

docs/THREAT_MODEL.md

@@ -66,8 +66,10 @@ accepted from request input. Break-glass access lasts at most one hour and is
 not a substitute for ordinary role policy.
 
 Local storage adapters assume the parent directory and host account are trusted.
-They reject a symlink at the configured final path and apply private file modes,
+They reject a symlink at the configured final path and apply bounded file modes,
 but they do not defend against a concurrent privileged actor replacing path
 ancestors during an open. The synchronous JSONL adapter deliberately favors
 durable, bounded evidence over maximum request throughput; the application owns
-rotation, retention, disk monitoring, and health escalation.
+rotation, retention, disk monitoring, and health escalation. Its default is
+mode `0600`; the sole wider option is mode `0640` for a deployment-assigned
+collector group. The toolkit does not select or change that group.