docs(#771): hold unimplemented runner routes

README.md

@@ -205,13 +205,13 @@ docker compose up -d valkey
 # Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
 ```
 
-### PostgreSQL and federated activation (held)
+### Held future procedure
 
 The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
 current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
 invoke initialization SQL, or treat the planned migrator as currently executable.
 
-**Future activation procedure — non-executable until KBN-101-00, KBN-101-03, and KBN-101-05
+**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
 land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
 `mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
 this README—will provide the reviewed commands and secret-consumer interface.
@@ -237,7 +237,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- Database migration against a fresh Postgres
+- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.