Add whole-factory HVAC requirement and process traceability spec

- facility-security.md: continuous temperature/humidity/PM control, zoned
  filtration, burning-season PM2.5 design point, HVAC in PV/battery sizing
- traceability.md: end-to-end per-order customer traceability, batch
  genealogy, log-at-source principles, machine data access as a
  procurement requirement

docs/traceability.md

@@ -0,0 +1,60 @@
+# Process Logging and Traceability
+
+Every step of production is logged continuously, so that every record is
+traceable end to end for the customer. This is a set requirement, and it is
+the core specification for the factory software this repository will
+eventually host.
+
+## What a customer can trace
+
+For any order, the customer can follow the full chain:
+
+1. **Audio intake**: file received, checksums, versions, who handled it,
+   approval trail
+2. **Mastering**: session log, engineer, settings, customer approvals
+3. **Cutting**: lacquer IDs, lathe parameters, stylus used, inspection
+   result
+4. **Galvanics**: silvering and plating batch IDs, bath chemistry logs,
+   father/mother/stamper genealogy (which stamper came from which mother
+   from which father), or the external stamper supplier and batch if bridged
+5. **Pressing**: press ID, operator, shift, mold and stamper IDs, cycle
+   parameters (temperatures, pressures, cycle times), PVC compound lot and
+   virgin/recycled mix, label lot
+6. **Quality control**: test pressing approvals, inspection results, reject
+   counts and reasons
+7. **Finishing and packaging**: trimming, sleeving, carton lot, packaging
+   partner batch
+8. **Fulfillment**: warehouse location, shipment or dropshipping consignment,
+   carrier tracking per end customer
+
+## Principles
+
+- **Log at the source**: machine data comes from the machine (the presses
+  and the plating rectifiers expose PLC data; the AD12 supports remote
+  monitoring), not from manual transcription. Manual steps get simple
+  operator check-ins, not paperwork.
+- **Batch and genealogy first**: every physical artifact (lacquer, father,
+  mother, stamper, press run, box) gets an ID, and every ID knows its
+  parents. A customer complaint about one record resolves to a specific
+  stamper, press, shift, and compound lot.
+- **Environment attached**: the whole-factory HVAC monitoring (temperature,
+  humidity, PM per zone) is logged on the same timeline, so any production
+  window can be correlated with plant conditions.
+- **Immutable and retained**: logs are append-only and retained for the
+  life of the customer relationship; stamper genealogy is retained as long
+  as the archive holds the metal parts.
+- **Customer-facing view**: traceability is a product feature, not an
+  internal file. Customers get a per-order view (portal or report) covering
+  the chain above, without exposing other customers' data.
+
+## Open design work
+
+- Data model for batch genealogy across all eight steps
+- Which PLC/machine interfaces each vendor exposes (ask Newbilt, Pheenix
+  Alpha, and Digital Matrix during procurement, before purchase)
+- Retention, backup, and PDPA handling for operator-linked records
+- Whether test-pressing approval workflows live in the same system from day
+  one
+
+This system should be specified alongside equipment procurement: machine
+data access is a purchasing requirement, not an afterthought.