docs: document data directory policy

Author: div0rce

docs/guardrails.md

@@ -1,5 +1,5 @@
 Status: Active
-Last updated: 2026-01-26
+Last updated: 2026-01-27
 
 # Guardrails
 
@@ -88,6 +88,11 @@ guaranteed to remain stable across different `engineVersion` values. Consumers m
 - `tests/node/**` may only import `env:node`; `tests/next/**` may only import `env:next` or `env:node`.
 - Enforcement: `check:environment-import-integrity`.
 
+### Data Directory Policy (Documented)
+
+- `data/**` must contain deterministic literals only (no runtime side effects).
+- `data/**` must not import from `app/**` or `lib/**`.
+
 ## Domain: Script Runtime Boundary
 
 ### Guardrail 47 — Script Runtime Boundary