feat: add architecture contracts and OpenHands proposal scopes v3

[Mopati123]

Purpose

Extend the certified repository-intelligence v2 baseline into v3 with explicit architecture-component contracts and deterministic machine-readable OpenHands proposal scopes.

v3 additions

• architecture-component contract schema
• typed component dependencies: depends_on, configures, deploys
• deterministic architecture-contract digest
• file-to-component membership mapping
• OpenHands proposal-scope generation for:
  • repo.read
  • test.execute
  • repo.patch
• deterministic scope digest
• explicit authority boundary:
  • authority_semantics=proposal_scope_only
  • execution_authorized=false

Architectural role

change request
  -> repository graph
  -> impact graph
  -> architecture components
  -> candidate OpenHands scope
  -> HPL admission
  -> authorized read/test/patch

The repository-intelligence layer can propose scope but cannot grant execution authority.

Truth boundary

v3 remains deterministic static analysis. Dynamic imports, reflection, generated code, runtime dependency injection, monkey-patching, and broad cross-language semantic relationships are not claimed as covered.

Review order

This PR is stacked on the certified v2 branch and remains draft until Repository Intelligence CI passes.

Certified v3 baseline

At head 67b07ca77b802fe2ba6a223264f9e5a46535c4bd, the dedicated Repository Intelligence CI completed successfully.

Certified v3 additions:

• architecture-component contract schema and deterministic contract digest;
• typed component dependencies (depends_on, configures, deploys);
• deterministic file-to-component membership mapping;
• OpenHands proposal-scope generation for repo.read, test.execute, and repo.patch;
• deterministic scope digest;
• explicit authority boundary: authority_semantics=proposal_scope_only, execution_authorized=false.

Truth boundary: v3 remains deterministic static analysis and scope proposal only. It does not grant execution authority and does not claim complete coverage of dynamic imports, runtime reflection/injection, generated code, monkey-patching, or broad cross-language semantics.

This commit is the certified Phase M v3 baseline. PR remains draft and unmerged.