feat: publish unlisted GTIN tool

AGENTS.md

@@ -89,10 +89,17 @@ request and is the only permitted reference (see "Editing rules").
 ## Privacy contract
 The `/datenschutz/` page makes concrete promises. Any change that would break one of
 them is a defect, not a style question:
-- no cookies, no `localStorage`, no analytics, no tracking;
+- no cookies, analytics or tracking. The standalone `/gtin/` tool is the only
+  `localStorage`/Cache API exception: it keeps its last 20 generated entries in
+  the browser and caches only its own offline app shell; it sends no tool data
+  to a server. The tool stays unlisted: no site navigation or page links, no
+  sitemap entry, and `noindex,nofollow`; only the tool itself links out to the
+  required legal pages;
 - `access_log off` in `nginx.conf` — never enable request logging;
 - `error_log /dev/null crit;` in `nginx.conf` — never write an error-log file either;
 - fonts, scripts, styles and images are served from this origin only;
+- the GTIN service worker is scoped to `/gtin/` and may not intercept other site
+  routes or delete caches owned by another application;
 - YouTube is embedded exclusively via the click-to-load facade
   (`youtube-nocookie.com`) — no iframe before the click, no preconnect;
 - the contact form never posts anywhere; it composes a local `mailto:` draft