docs: DR-tier-by-default batch — decisions 1-5 in CONTEXT, day0 ACL advice reversed, ceremony decision-4 policy block, WG disclosure (tester agreement + GO-LIVE D3), drill F-disposition table, REPORT

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

documentation/pilot/PETI-tester-agreement.md

@@ -44,12 +44,17 @@ mechanisms:
   credential to the hub. Peti's root password is his own and is never seen or changed.
 - **Out-of-band operator SSH is OFF** (`oob.enabled=false`). Felhom opens no operator tunnel into
   his box.
-- **The offsite WireGuard tunnel is OFF** (`wg_tunnel.enabled=false`). No Felhom-side connection
-  reaches back into his network.
+- **WireGuard tunnel DISCLOSURE (changed 2026-07-12, DR-tier-by-default decision 5):** the install
+  DOES enable an **outbound** WireGuard tunnel (`wg_tunnel.enabled=true`) — it is base
+  infrastructure like the Cloudflare tunnel, carries the offsite/DR backup traffic, and is the
+  future out-of-band management transport. It is strictly box-dials-out (no Felhom-side connection
+  reaches back into the network; the peer has no inbound route), it is listed in the installer's
+  typed host-mutation acknowledgement, and it can be disabled per-customer hub-side on request —
+  with the honest consequence that the DR tier and offsite backup stop working without it.
 
-These are asserted at install time (the byo config-write asserts `oob`/`wg_tunnel`/`lan_resolver`
-are all off before the install is marked complete) and were live-validated on the demo host during
-the GL-6 drill.
+These are asserted at install time (the byo config-write asserts `oob`/`lan_resolver` are off
+before the install is marked complete — `wg_tunnel` moved to the disclosed-default list in
+installer v1.15.0) and were live-validated on the demo host during the GL-6 drill.
 
 ---