chore(deploy): add railiance handoff guardrails [skip ci]

docs/new-hub-quickstart.md

@@ -194,10 +194,11 @@ POST events. Everything downstream is managed by inter-hub.
 ### Prerequisites
 
 The same build infrastructure used for inter-hub works directly:
-- haskelseed VM (`192.168.178.135`) with GHC 9.10.3 in the Nix store
+- haskelseed VM (`192.168.178.135`) as the CI/Nix build runner with GHC 9.10.3
+  in the Nix store
 - `devenv` for reproducible environments
 - The painful one-time Nix setup is already done — a new IHP project reuses
-  the same Nix store
+  the same Nix store when built on the runner
 
 ### Bootstrap a new hub repo
 
@@ -213,8 +214,9 @@ devenv up
 ```
 
 The first `devenv up` on a fresh machine takes 20–40 min to fetch Nix
-dependencies. On haskelseed, most dependencies are already in the Nix store
-and the setup takes ~2 minutes.
+dependencies. On haskelseed, most dependencies are already in the Nix store,
+which is why it is useful as a build runner. It is not the production runtime
+host for inter-hub.
 
 ### Connect to inter-hub's API
 
@@ -243,20 +245,10 @@ postEvent apiKey widgetId eventType metadata = do
 
 ### Shared database (optional)
 
-If your hub needs read access to inter-hub's tables (e.g., to join against
-`requirements` or `decision_records`), connect to the same PostgreSQL:
-
-```bash
-# In your hub's .env:
-DATABASE_URL=postgresql://ihp:ihp@192.168.178.135/interhub
-```
-
-Your IHP app can then use `query @DecisionRecord` directly without going
-through the API. This is appropriate for tightly-coupled hubs that are
-part of the same operational boundary.
-
-For loosely-coupled hubs (separate teams, separate deploy cadence), use
-the API only — do not share the database.
+Production inter-hub runs on Railiance01 K3s and uses PostgreSQL inside the
+Railiance cluster. Do not connect new hubs to a haskelseed database. Prefer the
+API boundary for extension hubs; request a governed read model or dedicated
+service account if a hub truly needs database-level integration.
 
 ### How fast is the Haskell build for a new hub?