fix(docs): fail closed on unscoped workflows

docs/DOCUMENTATION_EXPERIENCE_CONCEPT.md

@@ -255,6 +255,9 @@ Workflow topics:
 - keep each step actionable
 - mention blockers where the user would encounter them
 - link to field/reference topics instead of repeating field tables
+- for every user-facing workflow, declare one or more conditions and put
+  `required_scopes` or `any_scopes` on every condition alternative; the release
+  gate rejects an unscoped alternative
 
 Reference topics:
 

docs/INSTANCE_AWARE_DOCUMENTATION.md

@@ -34,6 +34,14 @@ opens the user projection: each contributed workflow still needs its own
 module, capability, permission, and runtime-policy conditions so baseline Help
 Center access does not imply authority to perform every documented task.
 
+This permission binding is a strict source contract. Every user workflow topic
+must declare at least one `DocumentationCondition`, and every alternative in
+its `conditions` tuple must include `required_scopes` or `any_scopes`. Module,
+capability, or configuration conditions alone are not sufficient because topic
+conditions are alternatives: one unscoped alternative would bypass all scoped
+ones. Manifest validation blocks a release containing such a topic, and Docs
+omits a non-compliant runtime-provider topic from the user projection.
+
 ## Conditions
 
 Documentation topics can declare: