docs(CONTRIBUTING): shared operator nym + TollGate vs net4sats

[felixfelix-bot]

Why

Two recurring sources of confusion, documented so future sessions and reviewers can check the convention from the tree instead of re-reporting the same misunderstanding:

1. c08r4d0r is the shared operator nym, not a personal identifier. Everyone who runs a TollGate goes by c08r4d0r. A private AP SSID like c08r4d0r-AB12 leaks no operator identity — it only means "this is the operator's private AP". This is directly relevant to fix(packaging): stop broadcasting the operator username in the default private SSID #487, whose "operator identity leak" premise misreads the nym as a personal username; see my comment there.

2. TollGate does not adopt net4sats branding. net4sats is a commercial re-brand, shipped as a separate whitelabel brand value (hostname, DNS, SSIDs, admin webroot all derive from brand). The two are $BRAND variants, not interchangeable.

What changed

CONTRIBUTING.md — new section "Branding, the operator nym, and net4sats" cross-referenced from the PR/issue guidance, stating both facts and pointing at the brand value as the source of truth.

Docs-only; no tests required (CI is unaffected).

[Amperstrand]

Verification: PR #508 (operator nym + TollGate vs net4sats in CONTRIBUTING)

Docs-only, one section in CONTRIBUTING.md (tested as-is at head 744e0b98ac88cd458fe07f12ae0e259ce7fea04b, MERGEABLE). I checked every factual claim in the new section against the brand machinery as merged — all of them hold:

• "brand derives hostname, DNS, AP SSIDs, admin webroot" — matches load_brand() in 99-tollgate-setup: /etc/tollgate/brand = net4sats → BRAND_HOSTNAME="Net4sats", anything else → TollGate; the hostname drives <hostname>.lan DNS, the public SSID is GATEWAY_NAME="${BRAND_HOSTNAME}-${RANDOM_SUFFIX}" (line 335), and the admin webroot is brand-selected in packaging/portal-build.sh (ADMIN_HOME=/www/net4sats for a net4sats build). This is the fix(portal): drop nodogsplash gatewaydomainname (5.0.2 splash redirect loop) + brand-selected hostname #432/fix(packaging): serve whitelabel configUI from a dedicated uhttpd section on :8090 #451 machinery, correctly described.
• "default private SSID prefix c08r4d0r-<suffix>" — verbatim at private_ssid="c08r4d0r-${RANDOM_SUFFIX}", and it is deliberately distinct from the brand-derived public SSID — so "an SSID like c08r4d0r-AB12 marks a private AP" is accurate. The framing is directly relevant to fix(packaging): stop broadcasting the operator username in the default private SSID #487, whose title ("stop broadcasting the operator username…") is exactly the misreading this section pre-empts.
• "representative operator identity" — if anything understated: besides the README.md and docs/merchant.md 0.07 profit-share examples the section cites, c08r4d0r is also in the shipped defaults (config_manager_config.go:286, default profit share; config_manager_identities.go:46, default identities entry), which strengthens the "shared nym, not a person" reading.

Two non-blocking notes: the body says the section is "cross-referenced from the PR/issue guidance" — the diff adds no back-reference there, the section just follows it and self-describes ("Read this before filing a PR or an issue…"); harmless, but the body slightly oversells the diff. And on the CHANGELOG rule: repo guidance says doc-only one-liners may be batched but not skipped — precedent is mixed (#227, a CONTRIBUTING-only change, landed with no entry), so a one-line Changed / Internal bullet would be tidy but I wouldn't hold the PR for it.

No code paths touched, no tests expected, placement and tone fit the file. Disposition: land.