Disable connector transports without peer pinning

docs/CONNECTOR_BOUNDARY.md

@@ -57,6 +57,13 @@ Every provider must:
 - preserve source provenance and revision metadata
 - emit connector audit events for imported or accessed files
 - treat remote ACLs as upstream checks, not as a replacement for GovOPlaN policy
+- use a transport that pins every connection to a policy-validated DNS/IP answer
+  and revalidates redirects; SDK transports without that guarantee fail closed
+
+SMB DNS endpoints therefore fail closed in private-network mode until the SDK
+supports connection-time pinning; explicit IP endpoints remain available. Live
+S3 access is disabled in all modes until `boto3`/botocore can be bound to the
+pinned transport, including SDK-managed redirects and endpoint discovery.
 
 ## Non-Goals For Files