feat(ci): enforce runtime-validation image separation

Add Dockerfile boundary checks and deployable image purity validation for backend/frontend runtime artifacts. Wire enforcement into CI workflows and document runtime-vs-validation ownership.

docs/CICD_MULTI_STAGE_BUILD.md

@@ -148,6 +148,32 @@ jobs:
   `.gitea/workflows/cicd-tests.yaml` own CI validation and checks.
 - Main CI never rebuilds the base image locally.
 
+### Runtime Boundary Enforcement
+
+The main build workflow now enforces separation between validation environments
+and deployable runtime artifacts before publishing the complete CICD image.
+
+- Dockerfile boundary check:
+  - Script: `scripts/check-dockerfile-boundaries.sh`
+  - Validates `Dockerfile.backend` and `Dockerfile.frontend` do not reference
+    CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`) and
+    do not install disallowed CI-only tooling.
+- Deployable image purity check:
+  - Script: `scripts/verify-deployable-image-purity.sh`
+  - Builds deployable backend and frontend production images and verifies known
+    CI/development binaries are absent from final runtime artifacts.
+  - Performs profile-specific metadata checks:
+    - Backend: Python module import probes and pip metadata checks for
+      disallowed CI/development packages.
+    - Frontend: OS package metadata checks (apk/dpkg when available) and
+      development package directory detection.
+
+Workflow location:
+
+- `.gitea/workflows/docker-build-main.yaml`
+  - `Verify deployable runtime boundaries`
+  - `Build and verify deployable runtime image purity`
+
 ## Local Development
 
 ### Building Base Image

docs/DEPLOYABLE_RUNTIME_CONTRACT.md

@@ -145,12 +145,20 @@ Note:
    definition.
    - Covered by: "Disallowed Tooling Classes in Deployable Runtime Images".
 
-## Future Enforcement Hooks (Out of Scope for PP-58)
+## Enforcement Hooks
 
-Potential follow-up automation under epic #66:
+Current enforcement implemented in CI:
+
+- Dockerfile target boundary checks:
+  - Script: `scripts/check-dockerfile-boundaries.sh`
+  - Workflow: `.gitea/workflows/docker-build-main.yaml`
+- Deployable runtime image purity checks:
+  - Script: `scripts/verify-deployable-image-purity.sh`
+  - Workflow: `.gitea/workflows/docker-build-main.yaml`
+  - Checks include binary presence and profile-specific package metadata probes
+    to detect CI/development tooling leakage.
+
+Future follow-up automation under epic #66 may expand this with:
 
-- Policy checks validating final image layers do not include disallowed tooling
-  classes.
 - Contract tests that assert documented health/startup behavior.
-- CI checks that verify Dockerfile target boundaries remain aligned with this
-  contract.
+- Additional policy checks for drift detection and broader runtime compliance.

docs/DEVELOPMENT.md

@@ -34,9 +34,34 @@ When changing deployment behavior or image composition, treat
 
 Scope boundary:
 
-- This repository separates contract definition from enforcement mechanics.
-- CI workflow rewiring and test execution redesign are out of scope for PP-58
-  and belong to follow-up work under epic #66.
+- Contract definition lives in `DEPLOYABLE_RUNTIME_CONTRACT.md`.
+- CI enforcement now includes Dockerfile boundary checks and deployable image
+  purity checks in `.gitea/workflows/docker-build-main.yaml`.
+- Broader workflow redesign and deployment wiring remain out of scope for this
+  repository's runtime contract document and belong to follow-up work under
+  epic #66.
+
+## Runtime vs Validation Enforcement
+
+Deployable runtime artifacts and validation environments are intentionally
+separated.
+
+- Validation tools (lint/typecheck/test/browser tooling) belong to CICD image
+  paths (`Dockerfile.cicd-base`, `Dockerfile.cicd`) and CI validation
+  workflows.
+- Deployable runtime paths (`Dockerfile.backend`, `Dockerfile.frontend`
+  production target) must remain independent of CI-only tooling layers.
+
+Automated checks:
+
+- `scripts/check-dockerfile-boundaries.sh` validates deployable Dockerfiles do
+  not depend on CICD images or install disallowed CI-only tools.
+- `scripts/verify-deployable-image-purity.sh` inspects built deployable images
+  and fails if CI/development binaries or package metadata artifacts are
+  present.
+
+These checks run in `.gitea/workflows/docker-build-main.yaml` before publishing
+the complete CICD image.
 
 ## Quick Start