Register with repo-manager and add agent guidance

Register gate-house as category: tooling, domain: infotech, workplan
prefix GH-WP, via rmgr scaffold. Baseline files: .repo-classification.yaml,
SCOPE.md, AGENTS.md, workplans/GH-WP-0001-foundation.md. rmgr conform
passes with no findings.

SCOPE.md is derived from INTENT.md; GH-WP-0001 targets milestone M0
(executable skeleton) from ArchitectureBlueprint.md §41.

Move ArchitectureBlueprint.md to the repository root, matching its own
reference layout (§32). spec/ retains the Active Secrets Management Canon,
the external standard Gate House conforms to.

Add CLAUDE.md documenting the document precedence (Canon → INTENT →
Blueprint → README), the load-bearing security invariants, the fixed
domain vocabulary, and the stable identifier scheme.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9

SCOPE.md

@@ -0,0 +1,38 @@
+# Scope
+
+Derived from `INTENT.md`. Gate House is deliberately narrow: it decides whether
+a requested action is authorized, and represents that decision as bounded,
+time-limited authority that downstream systems enforce.
+
+## In scope
+
+- deterministic authorization decisions (`GRANT` / `DENY` / `REQUIRE_APPROVAL` / `DEFER`)
+- principal / actor / runtime-identity separation
+- mandates, delegation, and attenuation
+- authority ceilings
+- tenant-, environment-, resource-, task-, and time-scoped grants
+- approval binding and step-up requirements
+- posture intake from King's Guard, restricting only
+- change-dynamics limits: quotas, budgets, concurrency, circuit breakers
+- credential-binding contract to Secrets Engine / OpenBao
+- emergency revocation independent of the actor
+- decision evidence, explainability, and protected audit
+- policy and decision versioning; fail-closed semantics
+
+## Out of scope
+
+Owned elsewhere in NetKingdom — see the responsibility table in `INTENT.md`:
+
+- human identity lifecycle and memberships — User Engine
+- tenant and organizational boundaries — Tenant Engine
+- authentication and federation — Key Cape
+- credential abstraction and lifecycle orchestration — Secrets Engine
+- secret storage, PKI, leases, dynamic secret engines — OpenBao
+- operational execution — Ops Warden
+- construction, reconciliation, recovery — Ops Mason
+- anomaly detection, behavioral risk inference, security memory — King's Guard
+- adversarial testing and attack simulation — Whitehat Security
+
+Also out of scope: inventing a new policy language, becoming an IAM suite,
+secret scanning, SIEM, autonomous remediation, and supporting every agent
+protocol. See "Non-Goals for the First Prototype" in `ArchitectureBlueprint.md` §3.