Document Gmail execution boundary and deployment invariants

[SSBrouhard]

Goal

Make the production boundary explicit so VMGA is not oversold as hard isolation without deployment controls.

Acceptance criteria

• Runbook states where Gmail credentials live and who can access them.
• Docs require agents to reach Gmail write APIs only through VMGA.
• Docs define out-of-band approval and evidence retention expectations.
• README language remains clear about advisory vs enforced modes.

[SSBrouhard]

Scope update (adversarial review triage, 2026-06-10): (1) name the TOCTOU-defeat property explicitly in boundary docs — broker recomputes proposal_hash from stored state and binds approvals under _state_lock, so caller-supplied fields cannot swap between approval and execution; (2) add a short 'complementary runtime controls' paragraph noting runtime sandboxes (e.g. WASM/capability-isolation runtimes such as IronClaw) are a SEPARATE layer that VMGA does not provide or claim.