Enforce private-by-default enablement templates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

SCOPE.md

@@ -74,13 +74,11 @@ services. S5 applications consume S4 templates and conventions, while
 
 ## Current State
 
-- Status: emerging — **now owns the forge layer responsibility** (decision
-  `d151d817`, 2026-08-11), which is S4's first concrete owned accountability;
-  still no S4-owned workplans
-- Inherited from `railiance-forge`: runner placement and labels, registry
-  retention, artifact lifecycle, package credentials. The Forgejo **workload**
-  becomes `rapp-forgejo`; this layer takes the **layer** responsibility, because
-  it already declared the handoff contract for exactly those concerns
+- Status: emerging, with reusable Forgejo workflow templates and an active
+  private-by-default template workplan.
+- S4 owns the consumer-facing contract for runner labels, registries,
+  credentials, and artifact evidence. `railiance-forge` continues to operate
+  those capabilities; they are not duplicated here.
 - Implementation: ArgoCD is deployed in the `argocd` namespace on CoulombCore as
   a cluster addon managed from S2 — verified still true 2026-08-12
 - **But GitOps does not reach the live cluster.** ArgoCD is not deployed on
@@ -151,5 +149,5 @@ keywords: [template, sdk, helm, deployment, developer, buildpack]
 ## Getting Oriented
 
 - Start with: `CLAUDE.md` (session protocol, OAS boundary rules)
-- Key files / directories: `workplans/` (empty), `Makefile`
+- Key files / directories: `workflows/`, `docs/`, `workplans/`, `Makefile`
 - Pre-conditions: railiance-platform (S3) must be operational