Add renderer boundary automation guard

docs/modernization/build-inventory.md

@@ -196,9 +196,9 @@ Known local toolchain state:
   longer expose raw OpenGL enum defaults; default texture formats, sampler
   filters/wraps, and render-target formats resolve through backend-owned
   overloads.
-  The Windows entrypoint also consumes backend-owned generic OpenGL error-code
-  and info-string tokens; WGL context/pixel-format constants remain in the
-  platform shell for a later platform-boundary slice.
+  The Windows entrypoint also consumes backend-owned generic OpenGL
+  error-code/info-string tokens and WGL core-context/pixel-format attribute
+  catalogs.
   Desktop VR drawing also consumes backend-owned scissor/depth/blend state,
   depth clear masks, active texture units, and fallback 2D texture unbind
   targets while retaining the existing VR SDK/platform bridge shape.
@@ -237,6 +237,10 @@ Known local toolchain state:
 - `windows-msvc-vcpkg-headless` validates manifest install/configure/build/test
   for the current headless component matrix; see DEBT-0007 for remaining app
   and platform triplet migration.
+- `scripts/automation/analyze.*` runs shader validation plus a
+  renderer-boundary guard that reports JSON and fails if active non-backend
+  source code reintroduces raw `GL_*`/`WGL_*` constants outside the allowed
+  legacy OpenGL implementation files.
 - `pp_ui_core` consumes vcpkg tinyxml2 only when `PP_USE_VCPKG_TINYXML2=ON`
   through the vcpkg preset; default and Android validation still use the
   retained vendored fallback tracked by DEBT-0012.