docs: codify flagship delivery ownership (TIN-3026)

[Jesssullivan]

Summary

• codify the six-repository delivery ownership boundary without assigning application lifecycle to infrastructure receivers
• name the private tailnet route as the sole digest-attested exact-head QA authority
• distinguish the stale-named production Pages publisher from two still-served legacy tss URLs that are retired as QA routes
• preserve GF as validation substrate, Blahaj as bounded infrastructure receiver, and Lab as bootstrap/preflight/custody support
• keep the net diff to AGENTS.md and docs/blog-shadow-preview.md only

Tracker

Linear: TIN-3026

Boundary

Documentation and agent guidance only. No UI, post prose, DNS, credential, workflow, deployment, environment approval, or production change.

Validation

• python3 scripts/validate-substrate-boundary.py --self-test
• python3 scripts/validate-substrate-boundary.py
• bash scripts/test-shadow-preview-digest-contract.sh
• git diff --check
• read-only live probes: both legacy tss URLs return 200
• workflow grounding: main run 29609289893 executed the production Pages deploy step
• independent blocker review: READY
• fresh hosted bazel-remote-gates is the authoritative GF proof

[Jesssullivan]

Exact-head review update for da110d40574abc162721bc80009883bf3f97b5fb:

• Independent adversarial review: GO, no blocking source findings.
• Hosted source/build checks are green.
• The GF-backed Bazel gate reached the declared shared-cache profile, minted its token, passed attachment, then failed at the first action because gf-reapi-cell.gf-rbe.svc.cluster.local:8980 refused the connection. This is tracked on TIN-2184 as substrate availability, not a blog source defect.
• The protected private-shadow dispatch remains unapproved; this ownership/docs PR does not justify a deployment ceremony.
• No rerun spam and no merge until the exact head is genuinely green under policy.

[Jesssullivan]

Correction at signed head 03ba8f239c6b56f1b2014c081ed784d3e768f490:

• the prior branch accidentally mixed operational workflow/Bazel changes into a documentation ticket; those paths are restored byte-for-byte to current main in this head;
• the net diff is now only AGENTS.md and docs/blog-shadow-preview.md;
• Blahaj is described only as the bounded infrastructure receiver, Lab only as bootstrap/runtime-policy/preflight/scoped-custody support, and GF only as validation substrate;
• Cloudflare Pages production and compatibility machinery remains documented, but it is not presented as the exact-head interactive QA authority;
• no private-shadow environment approval is requested for this documentation-only PR.

Local deterministic boundary and digest-contract checks pass. Hosted GF validation on this exact head is the merge gate.

[Jesssullivan]

Correction to the earlier da110d4 check classification: the gf-reapi-cell...:8980 connection refused result was endpoint/profile convergence evidence and belongs to TIN-3027, not TIN-2184 (quota pressure). The current exact head 03ba8f239c6b56f1b2014c081ed784d3e768f490 has not produced that endpoint result; its required bazel-remote-gates job is still queued for tinyland-dind with no runner assigned. The separate private-shadow job is intentionally waiting for environment approval and remains unapproved; it is not a required merge check for this ownership/docs-only head.

[Jesssullivan]

Exact correction head: 76e64704c31906d0c12045b17afb6601997e129a (signed).

Review found and removed one remaining topology overclaim. Both tss URLs still serve 200 legacy content, so they are retired as QA authorities rather than described as offline. The stale-named workflow is not globally build-only: pull-request runs build only, while eligible main/manual runs can publish the production transscendsurvival-org Pages project; main run 29609289893 confirms the deploy step. The private tailnet route remains the only digest-pinned exact-head QA authority. Independent re-review: READY. No UI, content, route, workflow, deployment, DNS, secret, or environment state changed.