905b3df74c
Host closeout: personally reviewed the PR diff and D601 read-only closeout recommendation. This adds a long-term docs/reference runtime unblock checklist and validation anchors that keep DB live evidence separate from runtime durability, require explicit DEV authorization for any live DB read/apply, prohibit Secret value output, and keep M3/M4/M5 acceptance blocked while runtime durability remains blocked. No deploy, restart, DB mutation, Secret read, live smoke, or acceptance claim is included.