Reference forge runner contract

INTENT.md

@@ -137,6 +137,8 @@ This layer is expected to evolve toward:
 * GitOps workflows with clear **review and rollback** expectations
 * Handoff contracts with `railiance-forge` for **runner labels, package
   credentials, registry endpoints, and artifact evidence**
+* Reusable templates that cite the forge-owned **runner/GitOps ownership
+  contract** before depending on privileged labels or credentials
 * Developer-facing **self-service templates** and portal entry points
 * SDKs and examples that make platform capabilities easy to consume correctly
 * Release evidence that S5 can use for **deployment readiness**

SCOPE.md

@@ -33,6 +33,8 @@ services. S5 applications consume S4 templates and conventions, while
 - Buildpacks and image builders
 - Handoff contracts to `railiance-forge` for runner labels, artifact evidence,
   and registry consumption
+- Template references to forge-provided runner labels and credentials documented
+  in `/home/worsch/railiance-forge/docs/ci-runner-actions-gitops-ownership.md`
 
 ---
 
@@ -107,7 +109,9 @@ services. S5 applications consume S4 templates and conventions, while
 
 - `railiance-platform` (S3) — pre-condition; provides services that S4 tooling depends on
 - `railiance-forge` — provides source forge runtime, artifact registries, and
-  runner substrate consumed by S4 workflows
+  runner substrate consumed by S4 workflows; its runner label and GitOps
+  boundary contract is
+  `/home/worsch/railiance-forge/docs/ci-runner-actions-gitops-ownership.md`
 - `railiance-apps` (S5) — consumer of S4 CI/CD and templates
 
 ---