Architecture R35: map all active commandments to verification and close uncovered checks

Follow-up to the 2026-10-18 architecture audit, linked to PAR-449 and the completed architecture rebuild PAR-408. Rules are in docs/architecture.md. Audit baseline: commit 08d99ee; all 18 architecture checks passed, which does not establish full compliance.

The main ArchitectureTest has 11 assertions covering parts of 9 numbered rules (10,11,12,14,17,20,24,30,32), plus 7 guest-access checks in the architecture package. Passing these checks does not prove every active commandment. For example, R20 checks use-case dependencies but not the single execute(ctx,input) method/Result contract; R12 bans transactions elsewhere but does not require facade transaction boundaries or prohibit direct persistence access.

Acceptance:

• Produce a rule-by-rule verification map covering every active commandment (21 merged, 27 retired): automated assertion, behavioral/integration test, review check or an explicitly documented gap. Inspect tests outside the architecture package before calling a rule uncovered.
• Add meaningful regression checks for missing structural constraints, including facade boundaries, use-case shape, RequestContext signatures and domain model/persistence separation, coordinating with the remediation issues.
• Assess tenant query/index scoping, input validation, DTO generation, error handling, metrics tag cardinality and layer-specific testing; raise evidence-backed follow-ups for additional violations discovered.
• Keep tenant safety and transaction correctness backed by behavioral tests rather than regex-only claims.
• Update the documentation to state precisely what CI enforces. Add negative fixtures proving new checks fail for representative violations; keep existing checks strict and run required suites.

This is a coverage audit and enforcement task, not a claim that every untested rule is violated.