Six new D-records codify rules that lived only in POLICY.md: D-60 no network on default launch path, D-61 dependency vetting checklist, D-62 dependency removal process, D-63 vendored binary rebuild process, D-64 no telemetry (architecture), D-65 license compatibility matrix. Closes T-28. Co-Authored-By: Claude <noreply@anthropic.com>