Release 0.0.2: M3 logger (CLI + GUI), GUI-first, CI release workflow

Crash-capture logger (M3):
- crash-safe JSONL (fsync per sample), size-based rotation, GPU-lost/recovered
  markers, atomic status file
- CLI: record run/start/stop/status/report (run = systemd-ready entrypoint)
- shared core.reccontrol so CLI + GUI drive the same recorder
- crashlog tests (writer, rotation, reader, summary, recorder)

GUI:
- Recording/Logs page: start/stop/interval controls, live status, post-crash report
- shared render helpers (format_raw/headline, render_summary)

Docs/decisions:
- GUI-first (D17); CLI keeps full parity
- D8 revised: user-local self-updating install primary, .deb optional
- planned: M12 session sharing (D16), M13 no-root auto-update from public repo (D18)
- versioning + CHANGELOG convention (D19)

Infra:
- .gitea/workflows/release.yml: build wheel+sdist and publish a Gitea release
  v<version> on push to main
- align version to the 0.0.x release line; bump to 0.0.2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/SPEC.md

@@ -31,8 +31,9 @@ RigDoctor's crash-safe logger is designed to fix exactly that.
 - Catch and preserve the machine's state in the seconds before a hard freeze.
 - Make hard-to-investigate gaming faults debuggable: collect scattered signals, correlate
   them, and explain them.
-- Offer **three ways to run**: full **CLI / headless** (works over SSH), a **desktop GUI**,
-  and a **system-tray / top-menu-bar applet** with quick actions. (D10/D11)
+- Be **GUI-first** (D17): the **desktop GUI** is the primary interface, complemented by a
+  **system-tray / top-menu-bar applet** for quick actions — backed by a **full CLI** that
+  keeps complete functionality for headless / SSH / scripting use. (D10/D11/D17)
 - Be modular: a novice installs a one-click "monitor + capture + report" bundle; a power
   user installs everything including the GUI, tray, and diagnostics.
 - Low overhead; safe defaults; no telemetry/phone-home.
@@ -135,7 +136,18 @@ rather than adding a new one.
 Interactive wizard: detect GPU vendor (NVIDIA-first) → present module menu grouped into
 bundles with descriptions and the exact packages each needs → resolve & install (apt first)
 → write config → optionally enable the `systemd --user` logger service and pick its trigger
-mode. Delivered alongside the `.deb` (D8). Module list/bundling is final per D14.
+mode. Delivered with the user-local install (and the optional `.deb`) (D8). Module
+list/bundling is final per D14.
+
+### M12 — Session sharing / remote assist (D16)
+Lets a user (A) grant a helper (B) inspection access, as an escalating, consent-driven
+ladder: (1) **diagnostic bundle export** (inventory + recent capture log + report, one-way);
+(2) **live read-only view** of the dashboard + logs over a user-chosen tunnel
+(Tailscale/cloudflared/SSH — no RigDoctor-hosted relay); (3) **gated interactive terminal**
+wrapping an existing tool (tmate/sshx), read-only by default, read-write only on explicit
+consent. Per-session consent, ephemeral revocable tokens, permission escalation (view ≠
+shell), and a session audit log. Tier 3 is a deliberate, consent-gated exception to the
+read-only stance (D9). Built in Phase 6.
 
 ## 5. Non-functional requirements
 - **Zero hard deps for the core/CLI/daemon** — Python stdlib + tools already present. **Qt
@@ -144,8 +156,9 @@ mode. Delivered alongside the `.deb` (D8). Module list/bundling is final per D14
 - **Crash-safe logging** — flush + `fsync` per sample; bounded disk usage.
 - **Low overhead** — default ≤1 Hz sampling; negligible CPU/GPU cost. The always-on daemon
   is stdlib-only (no Qt loaded) so it stays tiny.
-- **Headless-equivalent** — every diagnostic capability is reachable from the CLI; the GUI
-  and tray are conveniences over the same engine, never the only way to do something.
+- **GUI-first, CLI-complete** (D17) — the GUI is the primary interface, but every capability
+  is *also* reachable from the CLI so RigDoctor runs fully headless (SSH/servers). Both
+  front-ends sit over the same engine; neither is the only way to do something.
 - **Privacy** — local only; inventory export is opt-in and reviewable; no telemetry.
 - **Portability** — graceful degradation when a sensor/tool is unavailable (N/A, not crash).