feat(campaigns): separate GM truth from PC knowledge

Hidden truth lives in gm/; state/knowledge.md holds what the PC knows,
believes, and suspects. Everything else in a campaign stays player-facing.

campaigns/_template/gm/README.md

@@ -0,0 +1,24 @@
+# GM only
+
+Truth the PC has not learned: hidden motives, unrevealed identities, off-screen
+events, and what is really going on.
+
+**Not player-facing.** The player may read anything else in the campaign, so a
+secret must never be written outside `gm/`. Nothing here may appear in a session
+log or in chat until the PC observes it or is told.
+
+Keep `../state/knowledge.md` as the PC's counterpart: what they know, believe,
+and suspect. When the two disagree, `knowledge.md` is what the PC currently
+thinks — narrate from it, not from here.
+
+## Retconning
+
+You may change a fact here after the fact, but only in the layer the PC has not
+perceived. The test is perception: if every session-log entry and everything in
+`state/knowledge.md` still reads exactly as before, the retcon is invisible and
+allowed. What the PC saw, heard, or was told stays fixed; the cause behind it
+may change.
+
+Use it to repair a plot that cannot otherwise be made to work. Do not use it
+liberally, and never to dodge a consequence the fiction already earned. Record
+each one in `retcons.md`.

campaigns/_template/gm/retcons.md

@@ -0,0 +1,12 @@
+# Retcons
+
+A log of facts changed after the fact. Each entry records what changed and why,
+so the change is not quietly contradicted later.
+
+A retcon is only allowed in the layer the PC has not perceived: every session
+log entry and every line of `../state/knowledge.md` must still read exactly as
+before. See `README.md`.
+
+| Session | What changed | Why |
+|---------|--------------|-----|
+|         |              |     |