Add requirements.txt (cryptography>=43.0.0,<45) and docs/PROD_RUNBOOK.md requiring SIGIL_SEAL_PASS and SIGIL_ANCHOR on separate storage. Document info findings R9/R12/R13 in DESIGN; leave R10 domain separation as a versioned follow-up (not backward-safe).