chore(tenancy): shared TenantRouter module + gitignore warehouse split (E3)

[brownjuly2003-code]

Summary

Two hygiene items from audit_fable_02_07_26.md §3.6 (plan_endgame E3):

• TenantRouter → src/tenancy.py: moved out of src/ingestion/tenant_router.py. Tenant routing is a cross-cutting concern used by both serving and ingestion; importing it from src.ingestion made the serving layer's dependency on the ingestion package spurious. Updated all 6 importers (3 src, 2 tests, plus docs/security-audit.md / docs/helm-deployment.md, which named the old path). docs/perf/entity-profile-2026-04-24.md is a dated profiling snapshot and intentionally left referencing the old path.
• .gitignore warehouse split: the blanket /warehouse/agentflow/ rule mixed genuine Iceberg runtime state with tracked DV2 SQL/Python source (191 files, historically force-added via git add -f). Narrowed to the two directories that are actually generated: orders/ (the Iceberg lake) and dv2/reference/build/ (generated parquet/manifest). New files under dv2/ no longer need -f.

The third E3 item — a post-transpilation assert that tenant-scope survives the DuckDB→ClickHouse transpile (§3.3) — turned out to already be done. ClickHouseBackend._assert_scope_preserved was added in b09d42b (2026-07-02, the ADR 0006 Phase 1 coherence commit) and is covered by test_translate_preserves_tenant_schema_qualification / test_assert_scope_preserved_fails_closed_on_dropped_qualifier in tests/unit/test_clickhouse_backend.py. Verified via git blame and by reading both the implementation and the tests — no code change needed there.

Test plan

• ruff check src/ tests/ scripts/ + ruff format --check (CI scope): clean
• mypy strict on touched files: clean
• Full unit suite: 1620 passed
• Targeted TenantRouter/tenant-isolation/ClickHouse-transpile tests: 65 passed
• Full integration suite: 238 passed / 52 skipped / 1 deselected / 4 errors
  • The 4 errors are docker.errors.DockerException (no Docker daemon on this Windows host) — pre-existing environment limitation, unrelated to this diff (Kafka/Iceberg testcontainer fixtures).
  • 1 initial failure (test_batch_executes_items_concurrently_and_reports_wall_time, a wall-clock timing assert) reproduced passing in isolation — host-load flake from running this diff's other verification passes in parallel, not a regression.
  • test_admin_ui_renders_dashboard deselected: confirmed via git stash that it hangs identically on clean main before this diff (pre-existing Windows httpx/anyio threading issue, unrelated file).

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 124 total / 28.93 per week
• Lead time for changes: avg 0.42h / median 0.0h
• Change failure rate: 75.81% (94/124)
• MTTR: 0.29h across 2 incident(s)