Publish complete signed module catalogs

docs/DEPLOYMENT_PROFILES.md

@@ -38,6 +38,22 @@ The K3s VM lab has two modes over the same Kubernetes profile:
 - `acceptance` requires independently controlled worker failure domains and can
   contribute target evidence.
 
+## Module composition and availability
+
+Official immutable API and WebUI images carry the verified `full` package
+profile. This is package availability, not runtime activation and not a license
+or tenant entitlement. The signed distribution manifest records the complete
+package composition; the desired module graph selects which installed modules
+are active; tenant module policy applies unavailable/available/forced ceilings;
+and Views/Policy control group and user presentation.
+
+Local and single-host profiles may use the supervised installer to download a
+signed catalog artifact into a private digest cache and mutate the local package
+environment during maintenance. A multi-host/shared-state profile must never
+change one replica in place. Its Admin install plan is a composition request:
+publish and roll out a new signed image whose package lock contains the target,
+then activate the module graph after all replicas report the same composition.
+
 ## Component Choices
 
 The installer may manage a component where its bounded profile is appropriate,