docs(claude): the progress tracker, the two timestamps, and the log's privacy rule (ADR-035)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -121,6 +121,14 @@ The repo is **green and shipping** — last tag `v0.15.0`. `task check` passes (
   Two-engine reconciliation (ADR-034, migration 019, off unless `TAPIR_RECONCILE_BASE_MODEL`):
   `internal/reconcile` (word diff, disputes, a local-model adjudicator) and
   `transcribe.Ensemble`; every model must be a local alias, enforced at start-up.
+  Progress and logging (ADR-035, migration 020): `internal/progress.Tracker` is the ONE writer of a
+  job's phases (saved to the row for the page, logged by the same call); engines and the reconciler
+  report through `progress.From(ctx)`, so `uploads.Transcriber` is unchanged, and a transcriber may
+  implement `uploads.Planner` to declare its own phases. The page tells running / quiet / lost from
+  two timestamps (`alive_at` heartbeat vs `progress_at`) and never shows a percentage that does not
+  come from real counts. **Nothing logged may carry transcript text, words from it, or the spool path.**
+  `TAPIR_SHOT_DIR=… go test -run TestRenderUploadProgressStatesForReview ./internal/web` renders every
+  state for a screenshot review.
   **Lint caveat:** `task check` does not fail on lint (#41: the Taskfile `|| echo` swallows
   findings) — run `golangci-lint run ./...` yourself until that is fixed.
 - `cmd/tapir` subcommands: `list`, `show`, `auth` (interactive host-side OAuth), `run` (batch