Add governed form handoffs

docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md

@@ -48,6 +48,9 @@ Runtime form submissions for validation, drafts, attachments, signatures, status
 - bounded list/detail/history/event APIs and accessible definition-driven WebUI
 - `forms_runtime.service_launcher` retaining exact Service and binding
   provenance
+- native Case and Workflow handoffs that commit a durable effect intent before
+  invoking the owner capability, use stable provider idempotency keys, and
+  reconcile outcome-unknown execution
 - migrations, uninstall guards, tenant summaries, events, recovery notes, and
   tenant/replay/stale-write/validation/handoff tests
 
@@ -81,6 +84,8 @@ Destructive retirement is blocked while state exists and requires a verified
 database snapshot plus an export or retention decision for referenced evidence.
 No local generated files are required, so API and worker nodes remain stateless.
 
-Anonymous public intake, concrete file/signature upload adapters, conditional
-multi-page layout, and automated target handoff execution remain product depth;
-the owner and security boundaries no longer depend on those additions.
+Anonymous public intake and concrete file/signature upload adapters remain
+product depth. Conditional multi-page definitions are resolved from Forms, and
+native Case/Workflow handoffs execute automatically when the exact owner
+capability is installed. Additional target kinds remain adapter depth; the
+owner and security boundaries no longer depend on those additions.