docs: record pilot boundaries and OpenAPI blocker

docs/workflow-discovery.md

@@ -140,6 +140,9 @@ copied application state.
 
 GitHub and all other remotes are read-only. Local commits, clones, fetches, and
 worktrees are allowed; remote mutation requires a separate change to policy.
+Yookr production source is also read-only during these pilots. Development
+tooling may be changed, and `yookr-workbench` is the explicit source-code
+exception.
 
 Credentials and `.env` files normally stay outside Git, the Nix store, and broad
 synchronization. The accepted `yookr-vpn.ovpn` is a narrow exception for Zenith
@@ -162,9 +165,9 @@ and build configurations, then provide an activation command.
   cross-system investigation.
 - Configure an S3 remote only for a real task with least-privileged credentials
   and explicit upload authorization.
-- Rerun the Yookr OpenAPI refresh after the deployed image exposes
-  `/full-api-docs/openapi.json`; run authenticated API checks only with current
-  user credentials.
+- Rerun the Yookr OpenAPI refresh after the deployed document defines its
+  referenced `ReadParameters` schema; run authenticated API checks only with
+  current user credentials.
 - Run the complete Herdr notification, fallback-agent, and safe worktree pilot
   with a real Monday ticket.
 - Keep Bruno, DBeaver, and existing PIM clients until their independent gates are