docs: promotion gates with existing project CD authority preserved

[pcvantol]

Coordinated architecture increment

GOVERNED_PROGRESSION_AND_DELIVERY_AUTHORITY_V1 with Forge #51, EP #104 and Workspace #16.

Clarifies the universal installer's deployment boundary: product composition and explicitly delegated operations do not transfer project/organization CD approval, credentials, production execution or rollback authority. Adds project-owned target/environment/trigger/approval/deploy contract semantics, no duplicate Workspace gate, exact artifact/operation evidence and controlled request-before-external-approval behavior.

Updates the ownership matrix, adds GP-P external-delivery-aware composition roadmap and links it from the existing canonical policy roadmap. TST/ACC/PROD labels do not grant rights; store submission and public release stay distinct. Existing artifact/installed qualification remains required where applicable. Full CD/UI integration does not become a first-canary gate.

Scope and merge

Four Markdown files only. No installer, pipeline, schema, source, version helper, package, grant, runtime or external configuration changed. Other SemVer/artifact PRs remain untouched. Owner requested these documentation merges when qualified; exact-head checks and cross-product consistency will be recorded before merge. Implementation remains PLANNED.

[pcvantol]

Coordinated increment closure: all four documentation PRs are squash-merged and verified. Forge Platform merge: a9b56476e858a9c6cff91aea4d7f77bdf166f9c7. Cross-repo merge/qualification record: pcvantol/forge#51 (comment) (Forge #51, EP #104, Workspace #16, Forge Platform #19). Foundation/CodeQL/TDE were green on f8c8e5180ff6f1ace35b86fdbcd1445d27dcfe38. The clarified CD/installer ownership and roadmap are MERGED_CANONICAL; external delivery-aware composition remains PLANNED. No installer, pipeline, version, external credentials, production deployment or live policy was changed.