TODO: UN-R155 (Cyber Security Management System) and UN-R156 (Software
Update Management System) mapping for this project — which CSMS
requirements this diagnostic-interface implementation addresses, and an
explicit statement of what's out of scope (R156 in particular: this project
has no software-update/flash orchestration, see docs/DESIGN.md's
Deferred/optional section).
Also intended to cover: what each telemetry/audit sink documented under
"Diagnostic data and GDPR" in the main README.md retains,
for how long, and under what basis — referenced there but not yet written
out here.