docs: centralize Markdown developer manual

docs/src/safety-boundary.md

@@ -0,0 +1,24 @@
+# Safety boundary
+
+Every checked-in F722 image inhibits PB0, PB1, PB4, and PB5 before normal
+board initialization. The interlock configures each pin as a low, push-pull
+GPIO output; it runs before clocks, board routing, UART setup, or RTIC tasks.
+
+There is no checked-in platform actuator route:
+
+- no DShot or PWM peripheral implementation is linked;
+- no TIM3/TIM5 motor task or DMA output path exists;
+- MAVLink input has no production authority path;
+- a future verified arm command is still acknowledged as unsupported.
+
+The protocol reference crate remains in the workspace only as a framing and
+arming-sequence reference. It does not grant hardware access or authority.
+
+Run the structural guard after any platform or board change:
+
+```sh
+cargo test -p platform-stm32f7 --test platform_safety_boundary --offline
+```
+
+This boundary is deliberately stronger than an application-level disarm flag:
+it removes the physical actuator implementation from the platform image.