README: Rudder's goal, private voice-to-text that you own

Under the desktop output, Rudder's goal from the start: offline, with no telemetry and no cloud. Your
own code and your own self-hosted speech model (NeMo-Speech.cpp and a ~742 MB model) on a modest
amount of CPU; after a one-time download of the runtime and model nothing needs the network (the
runtime was traced: zero sockets, zero DNS). Working out of the box is the aim; the first-run download
is still manual. Because a voice-to-text tool hears everything, changes to rudder-voice and
rudder-engine should come only from trusted people, each read by a second person. Planned: an egress
monitor that shows Rudder sends no data out.

README.md

@@ -629,6 +629,18 @@ text to an agent. Nothing leaves the computer.
 
 ![Rudder, the offline voice-to-text desktop app, running](documentation/readme-images/deploy5-desktop-rudder.png)
 
+**Rudder's goal, from the start: private voice-to-text that you own.**
+
+- **Offline, with no telemetry and no cloud.** Your own code and your own self-hosted speech model
+  (NVIDIA's open NeMo-Speech.cpp runtime and a small speech model, about 742 MB) run on a modest amount
+  of your computer's CPU. After a one-time download of the runtime and the model, nothing needs the
+  network; a trace of the speech runtime showed zero sockets and zero DNS lookups. The aim is that it
+  works out of the box: today the first-run download is still a manual step.
+- **Be careful who commits to Rudder.** A voice-to-text tool hears everything said near it, so one
+  bad change could turn it into spyware. Take changes to `plugin-designs/rudder-voice/` and
+  `backend/rudder-engine/` only from people you trust, and have a second person read every one.
+- **Planned: an egress monitor** that shows you, as it runs, that Rudder sends no data out to anyone.
+
 **The map app runs as a desktop app the same way.**
 
 ![Desktop app (Tauri), working](documentation/readme-images/deploy5-desktop.png)