docs: mark APK distribution as deployed

deploy/yaris-dashcam.sudoers

@@ -0,0 +1,13 @@
+# Dashcam USB storage operations performed by the yaris-obd service while it
+# runs as the unprivileged `yaris` user (modules/app_dash.py). The dashcam is
+# mounted read-only by default and only remounted read-write for the brief
+# duration of a validated delete operation, then restored.
+#
+# The mount point is fixed at /mnt/dashcam, so the mount/umount grants below are
+# scoped to that directory. The `rm` grant is scoped to the `rm --` form the app
+# uses after its own extension/realpath/mount-boundary validation.
+yaris ALL=(root) NOPASSWD: /usr/bin/mkdir -p /mnt/dashcam
+yaris ALL=(root) NOPASSWD: /usr/bin/mount -o r[ow] *
+yaris ALL=(root) NOPASSWD: /usr/bin/mount -o * /mnt/dashcam
+yaris ALL=(root) NOPASSWD: /usr/bin/umount /mnt/dashcam
+yaris ALL=(root) NOPASSWD: /usr/bin/rm -- *