docs(#1186): drop the "air-gapped" claim + add the channel-list definition

[LukasWodka]

RFC-0003 §9 messaging alignment — the accuracy half of #1186.

• tools-help/faqs.mdx: the FAQ literally answered "Do you support air-gapped clusters? → Yes", which is inaccurate — a running secure environment requires outbound connectivity, so it is not air-gapped. Reframed to "Can I run offline / on disconnected infrastructure?": offline install is supported, but the running environment has defined, auditable ingress/egress and raw data is never an egress channel.
• TERMINOLOGY.md: added the quotable "secure environment" definition (RFC-0003 §1 channel model — 3 ingress / 1 egress / nothing sideways) + the wording discipline: never "air-gapped" in external copy.

Deliberately not here:

• Website blog-post bullet ("air-gapped and sovereign deployments", tracebloc-website/posts/tracebloc-engineer-guide.mdx:54) — #1186 subtask 3 says coordinate with the positioning work, so that is left for @LukasWodka, not swept unilaterally.
• Internal node-local / model-IP precision note (subtask 4) — a small follow-up.

Targets develop.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation and terminology only; no application, API, or security-runtime behavior changes.

Overview
Aligns customer-facing copy with RFC-0003 §9 by stopping the inaccurate “air-gapped” claim and documenting how a secure environment should be described.

TERMINOLOGY.md adds a quotable definition under core product terms: tracebloc on customer-controlled infra with three ingress channels, one egress, nothing sideways, plus the approved external line (defined, auditable ingress and egress — raw data is never an egress channel). It explicitly bans “air-gapped” in external copy because the runtime needs outbound connectivity to the platform (e.g. messaging credentials); “almost air-gapped” is internal shorthand only.

tools-help/faqs.mdx (same messaging pass) reframes the connectivity FAQ away from “yes, air-gapped clusters” toward offline/packaged install where applicable, outbound-only operation, proxy support, and the same ingress/egress framing — including that experiments still need outbound HTTPS to the platform.

^{Reviewed by Cursor Bugbot for commit d3a5c05. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f58d4d3. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9a6e441. Configure here.}

[saqlainsyed007]

Review of the RFC-0003 §9 messaging block added to TERMINOLOGY.md. The intent is good, but the new copy contradicts the very rules this file declares itself the authority for ("the single source of truth… One concept, one word… Use the Preferred term. Avoid everything in Don't use"). Five points inline, mostly terminology self-consistency plus one accuracy concern. Requesting changes so the authority file doesn't ship words it bans elsewhere.

[saqlainsyed007]

Re-reviewed at d3a5c05. All five points from the previous review are resolved: "backend" and "tracebloc control plane" are both reconciled to the table's the platform, "data ingester" → data ingestor, "Service Bus credentials" → generic messaging credentials, and the "tracebloc software" term is downgraded to plain descriptive prose ("signed release artifacts"). Channel count stays consistent and no banned words remain in the block. LGTM.

[LukasWodka]

FR on staging → Ready for prod (staging FR sweep, 2026-08-06). Basis: content-only change — merged and live on staging. No product-behavior verification required for this class.