chore: enforce architecture and design rules

[flexdinesh]

• Require agents to identify behavior ownership, contracts and invariants; preserve semantic DRY, encapsulation and mode composition. Add PR evidence prompts and canonical workflow guidance.
• Reject unclassified Go packages, forbidden dependencies and misplaced process/SQL access. Guard frontend token use across CSS, TSX, utilities and inline styles with narrow documented exceptions and semantic regression tests.
• Keep architecture/design guards, contracts, JavaScript/browser suites and Go race tests local in pre-push, sharing builds. CI/release retain their existing static checks, build, generated drift and API smoke test; workflows are unchanged. Document this policy in agent instructions.
• The existing ci-required GitHub ruleset is now active: up-to-date lightweight checks required on main, no administrator bypass. Full local validation is recorded as PR evidence.
• Control browser time in the navigation-cue regression test so slow host round trips cannot hide its one-second lifetime; retain appearance, scroll, retrigger and expiry assertions.
• Validation: full local pre-push mise run check:push passed, including mise run check, guards/contracts, all 63 browser cases and Go race tests; embedded assets unchanged.
• Limits: automated guards cover declared dependencies and static styling; cohesive ownership, semantic DRY, runtime styling and visual quality still require review.