docs: keep HWLAB checks off master server

docs/reference/deployment-publish.md

@@ -38,6 +38,27 @@ Use `/home/ubuntu/workspace/hwlab` for D601 build and rollout operations.
 Do not treat `/home/ubuntu/hwlab` or other runner worktrees as the publishing
 truth.
 
+## Master Server Check Boundary
+
+Master server is only a control, coordination, Git, issue/PR, and short polling
+entrypoint for HWLAB. It must not run HWLAB validation workloads locally:
+`npm run check`, `npm run web:check`, Playwright/browser smokes, full test
+suites, build/preflight jobs, image publishing, or DEV CD checks belong on
+D601, Code Queue runners, or the formal CI/CD job plane.
+
+The master-side HWLAB clone may be used for lightweight source reading,
+`git status`, `git diff`, patch preparation, commits, PR creation, and polling
+D601/CI/CD status. If a validation command would consume significant CPU,
+memory, browser resources, Docker, k3s, registry, or long-lived process time,
+skip it on master and run the equivalent command from a clean D601 worktree or
+submit it through `hwlab-cli cicd submit`.
+
+Master wrappers may start short-lived D601 commands and poll their status, but
+the validation work itself must execute on D601 or CI/CD. A master-local
+timeout, browser hang, or resource shortage is not DEV-LIVE evidence and must
+not be turned into a product blocker; stop the local check and move the
+verification to D601/CI/CD.
+
 ## Regularization Stages
 
 | Stage | Current HWLAB state | Required next behavior |