Support flows end in GitHub issues; the robot never calls out

We want as many problem reports as possible to end up as GitHub issues carrying a useful Diagnostic report, including from people without a GitHub account, while questions and build help happen on a Discord server. Bugs go to issues, questions and sharing go to Discord, and security vulnerabilities go only to GitHub private vulnerability reporting (SECURITY.md); support is public with no guaranteed response time (SUPPORT.md).

The robot itself makes no outbound connection for support: no telemetry and no automatic crash upload. The Diagnostic report is built on the robot and shown to the user, and the user's browser carries it out: as a prefilled GitHub issue (needs an account; GitHub rejects URLs over about 7,000 characters, so only a summary goes in the URL and the full report is attached as a file), or through a Support relay. The relay is a small Cloudflare Worker that holds the secrets and creates the issue as a GitHub App, because an open-source firmware cannot hide a GitHub token or a Discord webhook URL. Anything sent to support is always redacted (Wi-Fi name, IP and MAC addresses, broker address and credentials), and the user sees the exact text before it leaves. A Discord thread becomes an issue only once its bug is confirmed.

We rejected a captcha on the relay, because Cloudflare Turnstile cannot run on a .local page; the relay uses rate limits, a size limit, a format check and a kill switch instead. We rejected GitHub Discussions, so that questions have a single home. Secrets live only in the repository's Actions secrets, and the relay's code lives in this repository. The Discord server is administered by a private bot that has no access to the relay's secrets.