docs: realign WP-0029 and boundaries with canon and nexus owners

Review ACTIVITY-WP-0029 against info-tech-canon, policy-nexus, and
State Hub retirement: activity-core keeps schedule and ops_run;
repo-manager owns consistency; hub-core owns progress ports.
Mark WP-0026 finished. Refresh INTENT, SCOPE, and repo-boundary.

.claude/rules/repo-boundary.md

@@ -1,8 +1,24 @@
 ## Repo boundary
 
-This repo owns **activity-core** only. It does not own:
+This repo owns **activity-core** only: when / what / where — schedules,
+ActivityDefinitions, rule/instruction evaluation, ops_run claim queue, and
+bounded declared side-effects.
+
+It does not own:
+
+- Task / work-item vocabulary → `info-tech-canon` (Task Model)
+- Responsibility / accountability / org roles → `info-tech-canon` (Organization Model)
+- Policy *content* (canon, ADRs) → owning repo files
+- Policy *publication* → `policy-nexus` (`policy.coulomb.social`)
+- Regulatory intake / interpretation → `risk-nexus`
+- Repo registry, C-rule consistency, work-record index → `repo-manager`
+- Messages, progress projections, hub ports → `hub-core`
+- Temporary compatibility routes → `state-hub` until STATE-WP-0079 retirement
+- Issue lifecycle / external tracker mapping → `issue-core`
+- AuthN / directory → `key-cape` / identity
+- AuthZ decisions → `flex-auth`
+- SSH certificates → `ops-warden` (`warden sign` only)
+- Secrets / API keys → OpenBao (`railiance-platform`); route via `warden route`
+- Tunnels → `ops-bridge`
+- Domain work execution → per-repo workers / `rein-aharness` claiming ops_runs
 
-<!-- TODO: List what belongs in adjacent repos, e.g.:
-- SSH key management → railiance-infra/
-- State hub code     → state-hub/
--->