feat: harden community production foundation through story 1.5

scripts/check-rust-module-boundaries.sh

@@ -20,6 +20,9 @@ check_no_match() {
 
 echo "Rust module boundary check: checking module-level imports"
 
+python3 "$ROOT_DIR/scripts/check-config-boundaries.py" --root "$ROOT_DIR" || status=1
+python3 "$ROOT_DIR/scripts/check-migration-boundaries.py" --root "$ROOT_DIR" || status=1
+
 check_no_match \
   "admin-api service modules must not depend on axum HTTP types" \
   '^\s*use\s+axum(::|[;\{])' \
@@ -66,6 +69,8 @@ Rules:
 - registry remains storage-only and HTTP-client agnostic;
 - runtime remains execution-only and storage/framework agnostic.
 - names and labels of metrics remain inside the typed crank-metrics contract.
+- process environment is read only by the leaf crank-config adapter.
+- PostgreSQL DDL and migration advisory locks are owned only by crank-registry migrations.
 
 EOF
 fi