docs: add staged rollout and rollback checklist

docs/ROLLOUT.md

@@ -0,0 +1,33 @@
+# WhisperGate Rollout Checklist
+
+## Stage 0: Local sanity
+
+- Start API: `./scripts/dev-up.sh`
+- Smoke API: `./scripts/smoke-no-reply-api.sh`
+- Check plugin files: `cd plugin && npm run check`
+
+## Stage 1: Canary (single Discord session)
+
+- Enable plugin with:
+  - `discordOnly=true`
+  - narrow `bypassUserIds`
+  - strict `endSymbols`
+- Point no-reply provider/model to local API
+- Verify 4 rule paths in `docs/VERIFY.md`
+
+## Stage 2: Wider channel rollout
+
+- Expand `bypassUserIds` and symbol list based on canary outcomes
+- Monitor false-silent turns
+- Keep fallback model available
+
+## Stage 3: Production hardening
+
+- Set `AUTH_TOKEN` for no-reply API
+- Run behind private network / loopback
+- Add service supervisor (systemd or compose restart policy)
+
+## Rollback
+
+- Disable plugin entry `whispergate.enabled=false` OR remove plugin path
+- Keep API service running; it is inert when plugin disabled