Repo hygiene + new workplans (RAIL-BS-WP-0008/0009)

- Add RAIL-BS-WP-0008 (activity-core WP-0016 deploy) and RAIL-BS-WP-0009
  (admin-sync smoke) from inbox asks 87952ff1 / aa8b7986
- Archive finished workplans to workplans/archived/ per ADR-001 convention;
  normalize frontmatter statuses (completed/done -> finished)
- Fill stack-and-commands.md, complete repo-boundary.md, refresh SCOPE
  Current State, add docs/operator-runbook.md for production-touching targets

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/rules/repo-boundary.md

@@ -1,8 +1,17 @@
 ## Repo boundary
 
-This repo owns **railiance-cluster** only. It does not own:
+This repo owns **railiance-cluster** only (OAS S2 — cluster runtime). It does not own:
 
-<!-- TODO: List what belongs in adjacent repos, e.g.:
-- SSH key management → railiance-infra/
-- State hub code     → state-hub/
--->
+- OS hardening, SSH, firewall, Terraform/cloud-init provisioning → `railiance-infra` (S1)
+- Platform services: PostgreSQL HA, Valkey, OpenBao, object storage → `railiance-platform` (S3)
+- CI/CD templates, developer portal, SDKs → `railiance-enablement` (S4)
+- Application Helm releases and workload manifests (incl. Gitea values) → `railiance-apps` (S5)
+- Forge/registry infrastructure (Gitea/Forgejo operation) → `railiance-forge`
+- Ecosystem graph/registry model → `railiance-fabric`
+- Identity/SSO/MFA (Keycloak, IAM profiles) → `net-kingdom`
+- State Hub code → `state-hub` / `the-custodian`
+
+S2 *does* deploy cluster-scoped operators and addons (cert-manager, cnpg
+operator, ArgoCD, nginx ingress) and owns kubeconfig custody, plus
+cluster-owned deploy/verify gates for workloads whose repos have no cluster
+access (e.g. the activity-core and llm-connect reconcile commands).