docs(skill): document portable isolation profiles

skills/apsuflow/SKILL.md

@@ -43,12 +43,13 @@ in the same change when applicable requirements or CLI behavior change.
 - Cluster servers replicate control-plane state; agents execute workloads but do
   not add quorum votes.
 - The unprivileged service daemon owns OCI children inside its delegated cgroup
-  v2 subtree. A supervisor may prepare root-owned host networking/firewall state,
-  but the long-running daemon must not gain root merely to bypass a failed
-  profile. Stable host support is defined by Linux capabilities rather than a
-  distribution, libc, or init brand; advertise a concrete profile only after its
-  complete isolation and golden path pass. Routine CLI use remains unprivileged
-  and authenticated.
+  v2 subtree. A supervisor may prepare root-owned cgroup and firewall state, but
+  the long-running daemon must not gain root merely to bypass a failed profile.
+  The signed artifact is proved on systemd and runit profiles; support is defined
+  by equivalent Linux capabilities rather than a distribution, libc, or init
+  brand. `doctor` must name the effective supervisor and writable delegated
+  boundary, and apply must fail closed when that boundary is missing. Routine CLI
+  use remains unprivileged and authenticated.
 - `.apsu` contains desired workloads and infrastructure, never secret values or
   mutable runtime state.
 - Services are continuously reconciled. Jobs are finite run-to-completion work.