docs: Campaign LA — pinned launch-contract schema COMMITTED into plan LA1

The LA3 Opus review process note was right: the contract both sides
implement lived only in orchestrator prompts, which is exactly the drift
mode the pin exists to prevent (and it produced the paths-key CRITICAL).
The schema, field rules, probe-mode discriminator, and status vocabulary
are now a binding plan section; amendments change this text first,
implementations second. Ledger: LA3 fix round dispatched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.App/Platform/GraphicalHostPlatformServices.cs

@@ -1,4 +1,5 @@
 using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
 using AcDream.App.Rendering;
 using AcDream.Platform;
 
@@ -10,6 +11,21 @@ internal enum GraphicalHostOperatingSystem
     Linux,
 }
 
+/// <summary>
+/// Campaign LA slice LA1: a <c>[SupportedOSPlatformGuard]</c>-annotated
+/// runtime-OS check, for code OUTSIDE <c>Platform/</c> that needs a
+/// CA1416-recognized guard around a Linux-only API (e.g.
+/// <c>AppCredentialResolver</c>'s <c>File.GetUnixFileMode</c> call) without
+/// re-detecting the OS itself — <c>LinuxPlatformBoundaryTests
+/// .OperatingSystemChecksRemainInsidePlatformOwners</c> requires every such
+/// check to live under this folder.
+/// </summary>
+internal static class RuntimePlatformGuard
+{
+    [SupportedOSPlatformGuard("linux")]
+    internal static bool IsLinuxRuntime => System.OperatingSystem.IsLinux();
+}
+
 internal sealed record GraphicalNativeDependency(
     string Feature,
     string PublishedFileName);