docs(security): mark path/ssrf guards as standalone, not wired to enforcement

path-guard.js and ssrf-guard.js (CORE-SU.A3) are exported from
permissions/index.js but are not called by OperationGuard.guard() and
are not registered as a PreToolUse hook. No write path or outbound
request is validated by these guards automatically today.

Add the same standalone-library notice prompt-guard.js already carries
so callers don't assume runtime enforcement is active. No logic changed.

Epic: docs/framework/epics/core-super-update/EPIC-CORE-SUPER-UPDATE.md

Author: Pedrovaleriolopez

.aiox-core/core/permissions/path-guard.js

@@ -7,6 +7,26 @@
  * @module permissions/path-guard
  * @version 1.0.0
  * @story CORE-SU.A3
+ *
+ * ─── STANDALONE LIBRARY — NOT WIRED TO RUNTIME ENFORCEMENT ───────────────
+ *
+ * This module is exported from `permissions/index.js` but is NOT called by
+ * `operation-guard.js`'s `guard()` path, and is NOT registered as a
+ * PreToolUse hook. No write operation is validated against this guard
+ * automatically today. Callers must invoke `validateWrite()` /
+ * `isTraversalAttempt()` explicitly wherever path-write safety is required
+ * (e.g. app code writing to disk on behalf of untrusted input).
+ *
+ * If/when this is wired into `OperationGuard.guard()` or a hook, remove
+ * this notice and document the integration point here.
+ *
+ * ─── USAGE ────────────────────────────────────────────────────────────────
+ *
+ *   const pathGuard = require('.aiox-core/core/permissions/path-guard');
+ *   const result = pathGuard.validateWrite(targetPath);
+ *   if (!result.allowed) {
+ *     // Block: result.reason available
+ *   }
  */
 
 'use strict';

.aiox-core/core/permissions/ssrf-guard.js

@@ -16,6 +16,26 @@
  * @module permissions/ssrf-guard
  * @version 1.0.0
  * @story CORE-SU.A3
+ *
+ * ─── STANDALONE LIBRARY — NOT WIRED TO RUNTIME ENFORCEMENT ───────────────
+ *
+ * This module is exported from `permissions/index.js` but is NOT called by
+ * `operation-guard.js`'s `guard()` path, and is NOT registered as a
+ * PreToolUse hook. No outbound request (WebFetch, MCP call, HTTP client) is
+ * validated against this guard automatically today. Callers must invoke
+ * `validateUrl()` / `isUrlAllowed()` explicitly wherever SSRF protection is
+ * required (e.g. app code fetching a user- or agent-supplied URL).
+ *
+ * If/when this is wired into `OperationGuard.guard()` or a hook, remove
+ * this notice and document the integration point here.
+ *
+ * ─── USAGE ────────────────────────────────────────────────────────────────
+ *
+ *   const ssrfGuard = require('.aiox-core/core/permissions/ssrf-guard');
+ *   const result = ssrfGuard.validateUrl(untrustedUrl);
+ *   if (!result.allowed) {
+ *     // Block: result.reason available
+ *   }
  */
 
 'use strict';