Add remote authorization audit matrix

docs/roadmap.md

@@ -82,8 +82,12 @@ Implementation order:
 
 - `[~]` Remote authorization enforcement audit.
   Acceptance criteria:
-  - `[ ]` Every remote mutable operation has an explicit resource capability
-    check before mutating local state or opening a host service.
+  - `[x]` Every remote mutable operation has an explicit resource capability
+    check before mutating local state or opening a host service, or is
+    documented as a signed-log import / owner-reviewed enrollment exception.
+  - `[x]` A test-backed remote guard matrix documents the expected guard for
+    each remote operation and fails if mutating/service-opening operations rely
+    on discovery alone.
   - `[ ]` Tests cover denied and allowed paths for CAS, KV, DB, document,
     pubsub, pipe, SSH proxy/admin shell, SSH cert metadata, and revocations.
   - `[x]` Initial two-daemon denied-mutation coverage exists for remote pubsub