Design and ship explicit session-automation consent language (PRD §7)

[myselfsiddharth]

Context

Follow-up from #37 (docs/privacy/session-custody.md, requirement SC-05). PRD §7 requires "explicit customer consent language ('you are authorizing automation of your own account')" before Fork A rides a user's own authenticated session. Verified at audit time: this exists nowhere in the product — no UI copy, no CLI banner, no onboarding step, no ToS click-through. The only occurrence of consent language in the repo is the PRD requirement sentence itself.

This is not currently blocking Track 1: the gate authenticates to a local, self-hosted Grafana instance with fixture credentials (FIXTURE_ADMIN_USER/FIXTURE_ADMIN_PASS, src/testbed/constants.ts) that the project owns — there is no real customer account being automated, so there is no one to consent. It becomes required the moment any code establishes a session against a real user's real account.

What to produce

A product/legal decision, not a PR by default:

1. Where the consent moment lives (onboarding flow, first-run CLI banner, a stored consent record checked before every session-establishing run — pick one and say why).
2. The actual copy, reviewed by whoever owns legal risk here (founder, per the pattern in pivot brief §5's counsel-packet requirement).
3. Once decided, the checkable engineering form: a guard function that refuses to establish a session against a non-local target without a recorded consent acknowledgment, with a unit test on the refusal path.

Before you open the PR

• Consent moment and copy decided and documented
• Guard function + test, if the decision produces one
• docs/privacy/session-custody.md SC-05 status updated