docs: separate installer artifact trust boundary

docs/SYSTEM_ADMINISTRATOR_LIFECYCLE_USER_STORY.md

@@ -70,10 +70,16 @@ The canonical backlog item is
    state and can reconnect without losing progress.
 5. Package signature/checksum, version alignment, contract closure, migration
    graph, configuration schema, and health checks are mandatory gates.
-6. A failed or interrupted operation reaches a visible retry, forward-recovery,
+6. Remote artifacts are acquired by a deployment-owned downloader that permits
+   approved origins, pins the validated connection peer, enforces size and time
+   limits, and verifies signature/checksum before making a local immutable
+   artifact available. `pip`, `npm`, archive tools, and any compatibility Git
+   importer then run without unrestricted network access. A restricted-network
+   profile can satisfy the same contract through operator-prefetched artifacts.
+7. A failed or interrupted operation reaches a visible retry, forward-recovery,
    rollback, or manual-intervention state. It never reports success merely
    because the initiating request returned.
-7. An available update follows the same preview and confirmation path. Exact
+8. An available update follows the same preview and confirmation path. Exact
    repeated requests are idempotent.
 
 ### Horizontal scaling
@@ -114,6 +120,10 @@ The canonical backlog item is
 
 - Catalogs, artifacts, recipes, and configuration revisions have signatures,
   checksums, provenance, expiry/revocation semantics, and audit evidence.
+- Catalog and artifact retrieval is not delegated to an unrestricted package
+  manager. Approved-origin and peer-pinned download, response bounds,
+  signature/checksum verification, extraction safety, offline installation, and
+  deployment egress policy form separate defenses.
 - The installer has a dedicated narrow authority; normal domain permissions do
   not imply host/package-management access.
 - The UI distinguishes reversible configuration rollback from database or