fix(core): index modules project-wide so import gate covers modules outside sourceRoots

[abao-bot]

Problem

The module interface import gate failed to block an external file importing a module's internal file (instead of index.ts) when the target module directory was outside the configured sourceRoots. Observed via the Devin CLI hook; affects all bridges equally.

Root cause: buildModuleIndex scanned only sourceRoots (default ["src/"]), so modules outside those roots were never indexed. checkViolation silently passes when findOwningModule(target) returns undefined. Existing behavior tests masked this by mocking loadConfig with sourceRoots: [""].

Fix

• Decouple scan scope from enforcement scope: descriptor files are discovered across the whole project (skipping node_modules/.git), while edit-time enforcement (readonly, no-new-exports) remains limited to sourceRoots via the existing isWithinSourceRoot check.
• Add the missing src/core/utils/index.ts interface and repoint imports that reached into its internal files (config.ts, run-gates.ts, module-index-builder.ts).

Tests

• Index-builder tests rewritten: scanning is global regardless of sourceRoots; node_modules/.git exclusion covered.
• Behavior test for import gating now runs with default-style scoping (sourceRoots: ["src/"]), making the sibling-module case a true regression test.
• New e2e regression cases in Devin and Claude bridge hook tests: import bypassing an out-of-root module's interface is rejected.

Docs

• sourceRoots row updated in README (en/zh/ja): enforcement roots only; discovery is project-wide.

Version bumped to 1.1.4.