test(architecture): ratchet top-level layer direction and mutual imports (#10584)

* test(architecture): ratchet top-level layer direction and mutual imports

Declare a layer for every top-level src/ directory and root source file
(domain, contracts, foundation, providers, application, composition,
adapters) in scripts/lib/module-layers.mjs. verify:module-boundaries now also
builds the production import graph between those units and compares it with
a counted baseline: 45 unit pairs import a higher layer (248 imports) and 23
unit pairs import each other. A new upward pair, more imports on a recorded
pair, a new mutual import, or an undeclared unit fails; shrinkage is
reported so the baseline can be lowered.

* fix(architecture): enforce layers for isolated units

scripts/lib/module-layers.baseline.json

@@ -0,0 +1,74 @@
+{
+  "upward": {
+    "adb -> application": 4,
+    "android -> application": 10,
+    "apkSignature -> application": 3,
+    "apktool -> application": 3,
+    "application -> catalogDiscovery.ts": 1,
+    "application -> catalogIdentity.ts": 2,
+    "application -> mcpStartupPolicy.ts": 3,
+    "application -> serverIdentity.ts": 1,
+    "artifacts -> application": 8,
+    "browser -> application": 33,
+    "captures -> application": 2,
+    "composition -> cliCommandNames.ts": 3,
+    "config -> application": 2,
+    "config -> native": 1,
+    "desktop -> application": 5,
+    "domain -> contracts": 4,
+    "dotnet -> application": 4,
+    "electron -> application": 2,
+    "erlang -> application": 2,
+    "evm -> application": 2,
+    "firmware -> application": 4,
+    "flutter -> application": 1,
+    "frida -> application": 4,
+    "ghidra -> application": 17,
+    "go -> application": 2,
+    "gpu -> application": 2,
+    "hopper -> application": 13,
+    "ida -> application": 8,
+    "il2cpp -> application": 5,
+    "inspector -> application": 3,
+    "javascript -> application": 6,
+    "jeb -> application": 4,
+    "kuna -> application": 7,
+    "model -> application": 2,
+    "native -> application": 35,
+    "pcap -> application": 2,
+    "process -> artifacts": 20,
+    "providers -> application": 4,
+    "python -> application": 2,
+    "rust -> application": 2,
+    "signals -> application": 2,
+    "sqlite -> application": 2,
+    "v8 -> application": 2,
+    "wasm -> application": 2,
+    "windows -> artifacts": 2
+  },
+  "cycles": [
+    "application <-> artifacts",
+    "application <-> browser",
+    "application <-> config",
+    "application <-> desktop",
+    "application <-> dotnet",
+    "application <-> frida",
+    "application <-> providers",
+    "artifacts <-> dotnet",
+    "artifacts <-> firmware",
+    "artifacts <-> gpu",
+    "artifacts <-> javascript",
+    "artifacts <-> native",
+    "artifacts <-> process",
+    "catalogIdentity.ts <-> recordedCatalogDigests.ts",
+    "cli <-> cli.ts",
+    "cli <-> cliBrowserScenarioCommands.ts",
+    "cli <-> cliEvidenceCommands.ts",
+    "cli <-> cliObservationOptions.ts",
+    "cli <-> cliOutput.ts",
+    "config <-> filesystem",
+    "contracts <-> domain",
+    "main <-> server",
+    "process <-> windows"
+  ]
+}