State hub update and Containerization

docs/ARCHITECTURE-BLUEPRINT.md

@@ -726,6 +726,10 @@ Recommended container model:
 - Restricted tools are mounted from licensed local paths.
 - Network access is declared per extension and per assessment profile.
 
+The baseline `Containerfile` packages the local CLI, schemas, sample profiles,
+and incubating extensions. See `docs/CONTAINER.md` for mount contracts and the
+extension-specific image path.
+
 Optional service model:
 
 - service lists extensions and profiles,