Rewrite SKILL.md TL;DR to eliminate privacy contradiction

Replace blanket "No user prompts or assistant responses are stored or
collected" claim with precise statement: "OTLP telemetry collects only
metadata — never prompt or response text." This removes the
contradiction that scanners flag between the privacy claim and the
routing behavior that sends {role, content} for manifest/auto scoring.

Author: brunobuddy

.changeset/fix-tldr-contradiction.md

@@ -0,0 +1,5 @@
+---
+"manifest": patch
+---
+
+Rewrite SKILL.md TL;DR to remove blanket "not collected" claim that contradicted routing behavior. Now precisely states what each data path does.

skills/manifest/SKILL.md

@@ -16,7 +16,7 @@ Source: [github.com/mnfst/manifest](https://github.com/mnfst/manifest) — MIT l
 
 ## Security & Privacy
 
-> **TL;DR** — No user prompts or assistant responses are stored or collected by Manifest's telemetry pipeline. No file contents are transmitted. The API key (`mnfst_*`) authenticates your telemetry — it is not exfiltration. When `manifest/auto` routing is active, the last 10 non-system messages (`{role, content}` only) are sent to the routing endpoint for scoring — disable this by setting a fixed model. In local mode, all Manifest data stays on your machine.
+> **TL;DR** — OTLP telemetry collects only metadata (model, tokens, latency, tool names) — never prompt or response text. When `manifest/auto` routing is active, the last 10 non-system messages are sent to the routing endpoint for tier scoring; set a fixed model to avoid this. The API key (`mnfst_*`) authenticates your telemetry — it is not exfiltration. In local mode, all data stays on your machine.
 
 ### External Endpoints