Gateway-mediated SSoT: audit template and runtime state writes

[islee23520]

Source

• docs/roadmap-reality-lock.md notes some gateway templates include loaders and clients that read/write local state, and not all state is gateway-mediated.

Current state

.lux/ is the SSoT, but some orchestration paths may bypass gateway validation or audit.

Acceptance criteria

• Inventory direct filesystem reads/writes in gateway templates and runtime orchestration paths.
• Classify each path as allowed SSoT write, projection read, or migration target.
• Add validation/audit around state-changing paths that should be gateway-mediated.
• No silent fallback to stale caches, environment variables, or docs-only state.