docs: freeze cicd special-case boundaries

scripts/src/help.ts

@@ -12,7 +12,7 @@ export function rootHelp(): unknown {
       { command: "server status", description: "Show fixed ports, containers, service health, and public URLs." },
       { command: "server swap status|ensure [--path /swapfile] [--size 2GiB] [--dry-run]", description: "Inspect or idempotently create host swap for low-memory main-server operation." },
       { command: "server logs [--tail-bytes N]", description: "Return bounded tails from file logs and docker logs." },
-      { command: "server rebuild <backend-core|frontend|dev-frontend-proxy|provider-gateway|todo-note|code-queue-mgr|project-manager|baidu-netdisk|oa-event-flow>", description: "Build first, then serialize, force-recreate, and validate one Compose service." },
+      { command: "server rebuild <backend-core|frontend|dev-frontend-proxy|provider-gateway|todo-note|code-queue-mgr|project-manager|baidu-netdisk|oa-event-flow>", description: "Maintenance-only local Compose rebuild for reviewed main-server services; unsupported objects return structured errors instead of falling back to source builds." },
       { command: "provider attach <providerId> [--master-server URL] [--up] [--force]", description: "Generate the minimal external provider-gateway env/compose bundle; only master server URL and provider id are required." },
       { command: "ssh <providerId> [ssh-like args...]", description: "Open a Host SSH / WSL SSH maintenance session through the provider-gateway bridge with built-in remote helper tools in PATH." },
       { command: "ssh <providerId> apply-patch [tool args...] < patch.diff", description: "Invoke the injected remote apply_patch helper directly over SSH passthrough and stream the patch from local stdin." },
@@ -87,6 +87,12 @@ export function serverHelp(action: string | undefined = undefined): unknown {
       masterServer: "do not use server rebuild backend-core for Rust iteration; it would build locally",
       d601: "use deploy apply --env dev --service backend-core and CI for Rust build/check",
     },
+    nonRebuildableBoundary: {
+      upstreamImages: ["filebrowser", "filebrowser-d601"],
+      infrastructure: ["database", "k3sctl-adapter"],
+      d601ExecutionPlane: ["code-queue"],
+      policy: "unsupported objects return unsupported-server-rebuild and must not be coerced into main-server Compose source builds",
+    },
   };
 }