fix(ci): budget Runner package inspection and clarify Namespace scope

landing-zone-configurator/app/tests/local-runner.test.ts

@@ -24,6 +24,11 @@ import { approvableSummary } from "../apps/api/src/plans/execution.js";
 import { LocalPlanRunner } from "../apps/api/src/plans/local.js";
 import { summarizePlan } from "../apps/worker/src/plans/summary.js";
 
+// Package inspection copies/hashes the real Node runtime and invokes several
+// engine probes. Budget the complete test above each unchanged 10s probe limit,
+// including filesystem/process contention in the parallel hosted unit suite.
+vi.setConfig({ testTimeout: 30_000 });
+
 const id = "11111111-2222-4333-8444-555555555555";
 const ticket = "t".repeat(43);
 const origin = "http://127.0.0.1:3000";

landing-zone-configurator/docs/plan-execution.de.md

@@ -124,8 +124,11 @@ Diese Ressourcenprüfung bleibt vor einer zukünftigen Job-/Credential-Freigabe
   feste Parameterregeln und den eigenen Instanz-State-Key. Der aktuelle geprüfte
   Application-Quellstand unterstützt Public-Projekte mit oder ohne lokales Netz
   und Corporate-Projekte am ausgewählten Plattformziel, optional mit Secrets Manager
-  und Observability. Namespace-Dienste bleiben bis zum eigenen Kubernetes-Ausführungspfad
-  gesperrt. Ältere unveränderliche Quellversionen behalten die frühere Einschränkung
+  und Observability. Namespace-Dienste des Accelerators gehören ausschließlich zu
+  Platform Kubernetes und bleiben von Application-Projektbestellungen ausgeschlossen.
+  Namespaces in Clustern innerhalb einer Application Landing Zone sind Teil des Workloads;
+  mögliche spätere Building Blocks gehören nicht zu diesem Ausführungsvertrag. Die private/SNA-Ausführung
+  für Platform Kubernetes bleibt unter #37 vertagt. Ältere unveränderliche Quellversionen behalten die frühere Einschränkung
   auf Public-Projekte mit lokalem Netz.
   Die Antwort meldet ausdrücklich `cloudPlanExecuted: false` und
   `executionEnabled: false`; keine Schlüssel werden an den Browser geliefert.

landing-zone-configurator/docs/plan-execution.md

@@ -75,7 +75,7 @@ The UUIDs are placeholders and must come from the actually applied platform. App
 - Tenant and revision are determined server-side. Migration 014 persists immutable contract versions with Forced RLS and technical verification/version evidence. An access test or contract is not Apply approval.
 - POST `/api/v1/applications/templates` can jointly bind `platformRevision` and `targetKey`. Region and project type must match the contract target; cross-tenant contract IDs are not visible. A change creates a new version.
 - POST `/api/v1/applications/instances/:id/plan-input` accepts only `{}`. Owner is determined from session and order; other people's orders and client identity/backend overrides are rejected. Identity expiry, revocation, role removal and changed requester email are checked again.
-- The compiler uses exactly the order's contract and template versions, fixed parameter rules and own instance state key. The current reviewed Application source supports Public projects with or without a local network and Corporate projects attached to the selected platform target, with optional Secrets Manager and Observability. Namespace services require a separate Kubernetes execution path and remain blocked. Older immutable source versions retain their previous Public-with-local-network restriction. The response explicitly reports `cloudPlanExecuted: false` and `executionEnabled: false`; no keys are delivered to the browser. Immutable version/order policy is adopted as `applyPolicy` (`approval-required` or `direct`); `requiresExplicitApplyApproval: true` remains set for both. Direct policy is not execution approval.
+- The compiler uses exactly the order's contract and template versions, fixed parameter rules and own instance state key. The current reviewed Application source supports Public projects with or without a local network and Corporate projects attached to the selected platform target, with optional Secrets Manager and Observability. Accelerator Namespace services belong exclusively to Platform Kubernetes and remain excluded from Application project orders. Namespaces in clusters within Application Landing Zones belong to the workload; possible later Building Blocks are outside this execution contract. Private/SNA Platform Kubernetes execution remains deferred under #37. Older immutable source versions retain their previous Public-with-local-network restriction. The response explicitly reports `cloudPlanExecuted: false` and `executionEnabled: false`; no keys are delivered to the browser. Immutable version/order policy is adopted as `applyPolicy` (`approval-required` or `direct`); `requiresExplicitApplyApproval: true` remains set for both. Direct policy is not execution approval.
 
 Actual Application Plan/Apply uses the separately packaged immutable Application root, instance-specific S3 State and job-bound server-side credential grants. Runtime capabilities report whether the configured Application Runner is enabled; `executionEnabled: false` on compiler/preview responses means those calls did not execute a cloud operation, not that the entire runtime is disabled. A saved-plan Apply remains separately confirmed and bound to the exact artifact. Source merge does not enable or deploy this runtime.
 

landing-zone-configurator/docs/user-guide.de.md

@@ -83,8 +83,13 @@ Application-Owner-Gruppen auswählen. Eine neue unveränderliche Version veröff
 bestehende Versionen und Bestellungen werden nicht umgebunden. Der eingeladene Owner
 wählt diese Version im selben Arbeitsbereich. Public-Projekte unterstützen ein optionales
 lokales Netz; Corporate-Projekte verwenden das freigegebene SNA-Ziel. Beide unterstützen
-optional Secrets Manager und Observability. Namespace-Dienste benötigen weiterhin einen
-eigenen Kubernetes-Ausführungspfad. Symbolische Observability-Netz-ACL-Bindungen bleiben
+optional Secrets Manager und Observability. Namespace-Dienste des Accelerators richten
+sich ausschließlich an **Platform Kubernetes** und sind von aktuellen
+Application-Projektbestellungen ausgeschlossen. Namespaces in einem Cluster innerhalb
+einer Application Landing Zone gehören zum Workload. Mögliche spätere Building Blocks auf Application Landing Zones
+sind eine getrennte, deutlich spätere Produktentscheidung. Die private/SNA-Anbindung
+von Platform Kubernetes bleibt in [#37](https://github.com/stackitcloud/stackit-landing-zone/issues/37).
+Symbolische Observability-Netz-ACL-Bindungen bleiben
 bis zur Qualifikation ihrer tatsächlichen Egress-Quelle gesperrt. Bestehende Versionen
 mit älteren Runner-Quellen behalten ihren früheren Ausführungsumfang. Jede Bestellung
 verwendet einen eigenen State-Schlüssel; Veröffentlichung und Bestellung geben keinen

landing-zone-configurator/docs/user-guide.md

@@ -74,8 +74,13 @@ Under **Publication**, select the template, approved contract, matching target a
 permitted Application Owner groups. Publish a new immutable version; existing versions
 and orders are not rebound. The invited owner selects that version in the same workspace.
 Public projects support optional local networking; Corporate projects use the approved
-SNA target. Both support optional Secrets Manager and Observability. Namespace services
-still need a separate Kubernetes execution path. Symbolic Observability network ACL
+SNA target. Both support optional Secrets Manager and Observability. Accelerator Namespace
+services target **Platform Kubernetes only** and are excluded from current Application
+project orders. Namespaces in a cluster within an Application Landing Zone belong to the workload.
+Possible future Building Blocks built on Application Landing Zones are a separate,
+later product decision. Private/SNA access to Platform Kubernetes remains tracked in
+[#37](https://github.com/stackitcloud/stackit-landing-zone/issues/37).
+Symbolic Observability network ACL
 bindings remain blocked until their effective egress source is qualified. Existing
 versions on older Runner sources retain their previous execution scope. Each order uses
 its own State key; publication and ordering do not approve an infrastructure Apply.