Add opt-in CLI execution report files

docs/operations.md

@@ -26,6 +26,11 @@ configuration, or environment and submitting a new request.
 Generated artifacts, rendered prompts, model output, and run metadata are
 caller-owned data. Retention, encryption, backup, and deletion are deployment
 responsibilities.
+Optional [CLI execution reports](cli.md) also belong to the caller. They can
+contain sensitive identifiers even though they omit prompt and response bodies.
+Keep report paths separate from generated output and apply the same access and
+retention controls. Output and report writes are not transactional; an older
+report may remain when no terminal observation was produced.
 
 ## Deploy The Filesystem And Process