S19: consume versioned engineering resources and move landscape documentation

docs/S19-validation.md

@@ -0,0 +1,36 @@
+# S19 validation
+
+The [landscape specification](http://192.168.2.28:3000/wanjakrah/landscape/src/branch/main/specs/S19.md)
+and [resource inventory](http://192.168.2.28:3000/wanjakrah/landscape/src/branch/main/S19-classification.md)
+describe the repository split. Engineering owns the shared source; this project
+consumes its selected tag and commit through engineering.lock.json.
+
+Validated on 2026-11-08:
+
+- Full Maven verification: 73 backend tests and 19 standards regression tests.
+  Existing approved waiver retained; no new waiver or threshold change.
+- Full shared pipeline: frontend lint/build, 32 frontend tests, 4 Playwright
+  tests, both prebuilt Docker images and combined backend coverage
+  1771/1841 (96.20%).
+- Standalone backend and frontend Docker source builds passed. The backend used
+  a disposable PostgreSQL container and BuildKit secrets for test configuration.
+- Shared CI/release regression suites: 19 and 34 tests respectively.
+- Engineering bootstrap/generator suite: 7 tests, covering all component choices,
+  actual Maven regeneration with generated/ absent, drift including new files,
+  obsolete-file removal, moved tags and preservation of project-owned files.
+- Formatter integration checks passed. Upstream skills and attribution files
+  match their source snapshot byte for byte; only the skills index was adapted.
+- A separate generated example passed its common pipeline and a real isolated
+  deployment of two synthetic revisions followed by rollback. Production was
+  not used. See engineering's VALIDATION.md and tests/acceptance.py.
+
+Gitea build-run evidence for the migrated application commit is recorded with
+S19 in landscape. Its workflow checks the pinned release before invoking the
+same shared pipeline. Checkout and committed generated resources require no
+sibling repository checkout.
+
+Production deployment is a separate action. Live NAS SSH authentication,
+production credentials and rollback against pre-S19 retained releases were not
+exercised. The existing Compose project, database volume and release-state schema
+remain compatible. Legacy releases without retained health.sh use the current
+application health function; review that compatibility before production rollback.