WARDEN-WP-0004: repo hygiene and hub sync

Update SCOPE and README to reflect the shipped warden CLI, fill agent
rules for stack/architecture/boundary, archive finished workplans
0001–0003, and register WP-0004 in State Hub.

.claude/rules/repo-boundary.md

@@ -2,7 +2,16 @@
 
 This repo owns **ops-warden** only. It does not own:
 
-<!-- TODO: List what belongs in adjacent repos, e.g.:
-- SSH key management → railiance-infra/
-- State hub code     → state-hub/
--->
+| Concern | Owner |
+|---------|-------|
+| Tunnel lifecycle, `cert_command` wiring in tunnels | `ops-bridge` |
+| Host SSH principal files, force-command wrappers | `railiance-infra` |
+| Vault/OpenBao cluster deployment and unseal ceremony | `railiance-platform` |
+| Inter-Hub operator API keys, provider API keys (e.g. OpenRouter) | OpenBao / operator secret store |
+| State Hub service code and consistency tooling | `state-hub` |
+| Workstream coordination across custodian domain | `the-custodian` |
+| Human admin SSH key generation | self-service (`ssh-keygen`) |
+
+ops-warden issues **short-lived SSH certificates** only. It is not a general
+secrets manager and must not store long-lived API keys in Git, State Hub, or
+workplans.