feat: enforce signed target maturity evidence

docs/CAPABILITY_AND_INFRASTRUCTURE_FIT.md

@@ -503,6 +503,20 @@ Signatures cover UTF-8 JSON with the `signatures` member omitted, object keys
 sorted, compact `,`/`:` separators and non-ASCII characters escaped, matching
 the tool's deterministic canonicalization.
 
+`tools/assessments/boundary-evidence.py` is the bounded issuance path. It
+accepts a private target-run manifest conforming to
+[`capability-fit-boundary-run.schema.json`](capability-fit-boundary-run.schema.json),
+hashes each retained result file without following a final-component symlink,
+and excludes all paths and raw results from the signed receipt. Issuance is
+refused unless an independently trusted catalog, exact installed payload,
+signed installer receipt, and role-scoped installer authority already pass.
+Every claim must be covered by a supplied Ed25519 private key whose public key
+is authorized for the full proof interval; catalog and installer key reuse is
+rejected. The command immediately verifies its own result and atomically writes
+both the proof and a sanitized review. The complete operator procedure and
+recovery measurement definition are in
+[`TARGET_MATURITY_EVIDENCE_RUNBOOK.md`](TARGET_MATURITY_EVIDENCE_RUNBOOK.md).
+
 ```bash
 ./.venv/bin/python tools/assessments/capability-fit.py \
   --public \
@@ -513,6 +527,14 @@ the tool's deterministic canonicalization.
   --expected-external-provider-subject provider-production
 ```
 
+Promotion automation must opt into its required boundaries. Add
+`--require-reference-readiness` to require all six target scopes,
+`--require-external-provider-proof` when the product depends on a provider, and
+`--require-production-approval` for production admission. These switches turn
+missing, expired, revoked, mismatched, negative, or otherwise unchecked claims
+into a blocking exit status rather than merely reporting them as an unproven
+boundary.
+
 With `--installed-evidence`, this command performs comparison and proof-binding
 diagnostics. Without an installer receipt, the imported document remains
 unsigned, so neither it nor the boundary claim becomes accepted proof. Direct