fix: gate durable runtime readiness

docs/cloud-api-runtime.md

@@ -48,11 +48,22 @@ non-secret env flags:
 
 The Postgres adapter uses `HWLAB_CLOUD_DB_URL` from
 `hwlab-cloud-api-dev-db/database-url`; source records only the Secret reference
-and non-secret DNS contract. The adapter reports `runtime.ready: true` only
-after a live schema query proves the required runtime tables and columns exist.
-If DB auth or schema is missing, `/health/live` stays degraded and reports a
-runtime blocker such as `runtime_durable_adapter_auth_blocked` or
-`runtime_durable_adapter_schema_blocked`. Fixture data and env presence are
+and non-secret DNS contract. The adapter reports `runtime.durable: true` only
+after the configured adapter proves all durable gates through read-only runtime
+checks:
+
+- auth/query access to the configured DB path;
+- required runtime table and column schema;
+- the source-controlled migration ledger row for
+  `0001_cloud_core_skeleton` / `runtime-durable-postgres-v1`;
+- read readiness against the runtime tables used by audit and evidence
+  queries.
+
+If DB auth, schema, migration, or read readiness is missing, `/health/live`
+stays degraded with `runtime.durable: false`, `runtime.durableRequested: true`,
+and a runtime blocker such as `runtime_durable_adapter_auth_blocked`,
+`runtime_durable_adapter_schema_blocked`, or
+`runtime_durable_adapter_migration_blocked`. Fixture data and env presence are
 never promoted to `runtime.liveRuntimeEvidence`.
 
 If `HWLAB_CLOUD_DB_URL` and `HWLAB_CLOUD_DB_SSL_MODE` are absent, health