Document the completed Seriatim remediation

docs/roadmap/mvp.md

@@ -56,15 +56,17 @@ role will manage the native configuration needed to connect to it.
 - Builds use the application repository's own build contract, including any
   application-specific version-injection linker flags. The common baseline is
   `GOWORK=off`, `GOTOOLCHAIN=local`, `CGO_ENABLED=0`, and `-trimpath`.
-- Roles normally rebuild when the Git task reports a changed checkout, the
-  binary is absent, or an application-level version or smoke check shows that
-  the installed binary is unsuitable. They do not maintain fingerprints,
-  checksums, or sidecar build-state files for the MVP.
+- Roles normally rebuild when the Git task reports a changed checkout or the
+  binary is absent. An application-level version or smoke check may add a
+  trigger only when its feature specification explicitly requires that
+  production behavior. Roles do not maintain fingerprints, checksums, or
+  sidecar build-state files for the MVP.
 - Each application role exposes variables only for meaningful consumer
   choices, normally including its repository, selected version or revision,
-  source directory, binary path, dependency management, and Go Snap channel.
-  Fixed details of the upstream build contract need not become public
-  variables.
+  source directory, binary path, dependency management, Go Snap channel, and a
+  build-tool path when dependency opt-out permits another provisioning
+  mechanism. Fixed details of the upstream build contract need not become
+  public variables.
 
 ### Go toolchain