docs: qualify runner resource verification

docs/operations/CI_RUNNER.md

@@ -54,9 +54,9 @@ Dockerfiles are built in a separate pinned Kaniko container action with explicit
 job container receives no Docker socket. Kaniko uses `--no-push` and
 `--no-push-cache`, so CI validates the full backend and OpenSearch builds but
 does not publish images or export build output. The two builds run sequentially
-within one job. CI run 69 completed both builds under the configured per-job
-limits; this confirms the workflow path and resource fit for that run, not
-host-wide resource metrics. No registry credentials,
+within one job. CI run 69 completed both builds on the runner. Actual per-action
+resource-limit enforcement and peak memory or disk usage were not independently
+measured or verified. No registry credentials,
 production secrets, elevated container options, or arbitrary host mounts are configured.
 
 The Kaniko action uses the `linux/amd64` v1.28.5-debug manifest
@@ -205,8 +205,9 @@ run 66 succeeded. On head `d96fc4d3`, CI run 67 failed because the Caddy action
 looked for `/github/workspace/deploy/production/Caddyfile`, which was not
 mounted at that fixed path; Kaniko was skipped and smoke run 68 succeeded. On
 head `5d72bb09`, CI run 69 and smoke run 70 succeeded. CI validated the Caddyfile
-and built the backend and OpenSearch images using `${{ github.workspace }}`
-within the configured per-job limits. Image publishing, host-wide resource
+and built the backend and OpenSearch images using `${{ github.workspace }}`.
+Actual per-action resource-limit enforcement and peak usage were not
+independently measured or verified. Image publishing, host-wide resource
 metrics, and production deployment remain unverified. Root-guard tests
 use `setpriv` for negative cases when jobs start as UID 0 and separately test
 the host-audit guard with simulated UID 0 and UID 65534; the real host audit,

docs/operations/CURRENT_STATE.md

@@ -101,9 +101,10 @@ UFW rule details, and protected file metadata remain unverified.
   Caddy action's fixed `/github/workspace/...` path did not exist; Kaniko was
   skipped and smoke run 68 succeeded. On head `5d72bb09`, CI run 69 and smoke
   run 70 succeeded. CI validated the Caddyfile and built the backend and
-  OpenSearch images using `${{ github.workspace }}` within the configured
-  3 GiB / 2 CPU per-job limits. Image publishing, host-wide resource metrics,
-  and production deployment remain unverified. No VPS changes are made.
+  OpenSearch images using `${{ github.workspace }}`. Actual per-action
+  resource-limit enforcement and peak usage were not independently measured or
+  verified. Image publishing, host-wide resource metrics, and production
+  deployment remain unverified. No VPS changes are made.
 - An isolated local Compose smoke test built backend/OpenSearch images,
   reached healthy status for OpenSearch, backend, and Caddy, and returned HTTP
   200 for `/review` through Caddy. Its containers, networks, and volumes were
@@ -158,6 +159,7 @@ in the Caddy action because the runner tried to execute `validate` directly;
 Kaniko was skipped. CI run 67 then found that the action's fixed
 `/github/workspace` path did not contain the repository; Kaniko was skipped.
 The branch now passes Gitea's `${{ github.workspace }}` value into all three
-container action invocations. CI run 69 verified Caddy, both image builds, and
-fit within the configured per-job limits; smoke run 70 passed. Host-wide runner
+container action invocations. CI run 69 validated Caddy and completed both
+image builds; smoke run 70 passed. Actual per-action resource-limit enforcement
+and peak usage were not independently measured or verified. Host-wide runner
 metrics, image publishing, and production deployment remain unverified.