docs: keep HWLAB checks off master server

AGENTS.md

@@ -17,6 +17,7 @@ HWLAB 是硬件实验室运行面和控制面项目。本文是 agent、指挥
 
 - Runner 和指挥常用工作区是 `/workspace/hwlab`；进入仓库先检查分支与工作树状态，详见 [docs/reference/commander-collaboration.md](docs/reference/commander-collaboration.md)。
 - D601 发布/构建工作区是 `/home/ubuntu/workspace/hwlab`；不要把 runner 临时目录当作发布真相，详见 [docs/reference/deployment-publish.md](docs/reference/deployment-publish.md)。
+- Master server 只做控制、Git、issue/PR 和短轮询；HWLAB `check`、Playwright、本地构建、发布预检和 CI/CD 验证必须放到 D601/runner/CI/CD，详见 [docs/reference/deployment-publish.md](docs/reference/deployment-publish.md)。
 - 当前一律走 PR 工作流；不要直推 `main`、不要合并自己的 PR、不要改 PROD、不要重启服务。
 - `DC-DCSN-P0-2026-003` / [pikasTech/HWLAB#78](https://github.com/pikasTech/HWLAB/issues/78) 是当前 M3 虚拟硬件可信闭环的上位约束；其他任务不得把 SOURCE、LOCAL、DRY-RUN、fixture 或前端状态误报为 M3 DEV-LIVE。
 - 仓库禁止创建或提交 repo report 目录；验收、进展和结论只承载在 #7、专题 issue、每日简报或 PR/issue 评论。临时 JSON 只能写入 `/tmp`、`.state` 或 CI artifact，不能进入源码仓库。

docs/reference/deployment-publish.md

@@ -38,6 +38,27 @@ Use `/home/ubuntu/workspace/hwlab` for D601 build and rollout operations.
 Do not treat `/home/ubuntu/hwlab` or other runner worktrees as the publishing
 truth.
 
+## Master Server Check Boundary
+
+Master server is only a control, coordination, Git, issue/PR, and short polling
+entrypoint for HWLAB. It must not run HWLAB validation workloads locally:
+`npm run check`, `npm run web:check`, Playwright/browser smokes, full test
+suites, build/preflight jobs, image publishing, or DEV CD checks belong on
+D601, Code Queue runners, or the formal CI/CD job plane.
+
+The master-side HWLAB clone may be used for lightweight source reading,
+`git status`, `git diff`, patch preparation, commits, PR creation, and polling
+D601/CI/CD status. If a validation command would consume significant CPU,
+memory, browser resources, Docker, k3s, registry, or long-lived process time,
+skip it on master and run the equivalent command from a clean D601 worktree or
+submit it through `hwlab-cli cicd submit`.
+
+Master wrappers may start short-lived D601 commands and poll their status, but
+the validation work itself must execute on D601 or CI/CD. A master-local
+timeout, browser hang, or resource shortage is not DEV-LIVE evidence and must
+not be turned into a product blocker; stop the local check and move the
+verification to D601/CI/CD.
+
 ## Regularization Stages
 
 | Stage | Current HWLAB state | Required next behavior |