Verify Valhalla on arm64; correct driving-side and retention decisions

arm64 is no longer a risk: verified end to end on mikkeli-orin-nano-2
(L4T R36.4.7). The official image publishes linux/arm64, runs natively, and
the full pipeline works including a served route.

Corrects the Japan guidance. Advising a regional extract was wrong for the
admin build: driving side is a country-level property, and a Shikoku extract
produces no country row and drive_on_right=1, silently giving right-hand
traffic routing. Admins must come from the full extract; routing tiles may
still come from a region.

Decision 14 closed: recordings bounded with rotation, enforced by the writer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013kj58Jugkic783b8ZrtTVZ

docs/ORIN-RUNTIME.md

@@ -108,9 +108,17 @@ guidelines. Data does not.
 | Voice models | GB | Static |
 | Recorded sessions | GB per drive | **Unbounded** |
 
-Recordings are the problem. Without a retention policy the disk fills mid-drive
-and capture stops — silently, because a full disk is not a crash. A retention
-policy is a tier-1 concern, not housekeeping.
+Recordings are the problem. Without a bound the disk fills mid-drive and capture
+stops — silently, because a full disk is not a crash.
+
+**Recordings are bounded with rotation.** The recorder enforces its own ceiling and
+discards oldest-first; it does not rely on an external cleanup job that might not
+have run. Two properties matter more than the specific size:
+
+- The bound is enforced by the writer, so the failure mode is *losing the oldest
+  session*, which is recoverable, rather than *silently stopping capture*, which
+  is not.
+- A session in progress is never the one rotated away.
 
 ## Audio