[emaarco]

Summary

#82 reduced the root of src/ to the entries index.ts, api.ts and cli.ts, but nothing kept it that way. test/architecture.test.ts adds an ArchUnitTS rule that fails when another module lands there. The failure names the file, and CONTRIBUTING.md points to the test.

• New dev dependency archunit 2.5.4, pinned. It brings its own TypeScript 5.9 for parsing; the repo's TypeScript 7 is unaffected.
• vitest.config.ts sets globals: true because ArchUnitTS registers toPassAsync() on the global expect. The existing tests import describe/it/expect explicitly and are unaffected.
• The rule was checked both ways: green on main, and red on a stray src/stray.ts and on a root file without imports. A pattern that matches no file also fails, so a typo in a folder name can't pass silently.

The dependency is meant for the next rules too. The spike already shows what those would catch today: 59 import cycles (type and value imports are marked separately) and 7 imports from query/ into ops/. Those need a list of known violations first, so they are not part of this PR.

Checklist

• npm run typecheck passes
• npm run gate passes (2318 tests; one earlier run failed on the timing assertion in step3-ids-report.test.ts under high machine load, which also happened before this change)
• src/report/guide.ts and the matching page in docs/ are updated (only if a command, option or output changed)
• PR title is a changelog-worthy Conventional-Commit summary

Linked issue

None.