feat(domain): bind runtime policy into signed manifests

product-source/guanghu-knowledge-base/server/domain-access-orchestrator.test.ts

@@ -139,6 +139,14 @@ function validHandoff() {
   const payload = {
     domainId: DOMAIN_ID,
     repositoryId: 'REPO-014',
+    runtimePolicy: {
+      allowedSessionScopes: ['domain:enter', 'knowledge:read'],
+      forbiddenDataScopes: ['private:relationship-core'],
+      permissionPolicyRef: 'policy://origin-domain/default',
+      routeRef: 'domain-route://origin-domain/runtime',
+      themeOwner: 'fifth-domain',
+      themePackageRef: 'theme://origin-domain/lake-reflects-stars',
+    },
     schema: 'gh-aios.domain-manifest/v1',
     signerId: 'GH-LIGHTHOUSE-001',
     sourceCommit: 'b'.repeat(40),