Exclude forge contracts from runtime dependencies

docs/roadmap/remediation.md

@@ -81,7 +81,12 @@ it adds no token-format restriction, remote permission requirement, or probe.
 
 ## 2. Protect the runtime boundary from the new forge contract — P2
 
-Status: open.
+Status: complete.
+
+**Completed:** Added `forge` to the runtime dependency exclusions and covered
+both direct and transitive forbidden dependencies with focused graph fixtures.
+The complete checker test package and the actual compiled API/dependency check
+passed; the current runtime dependency graph remains accepted.
 
 **Evidence:** [dependency checker](../../internal/apicheck/main.go), especially
 `forbiddenRuntimeDependency`, and the runtime boundary in