Inventory architecture and public-surface growth

[callumalpass]

Summary

• extend the existing architecture checker with flexible reviewed surface baselines
• inventory all npm and Cargo package paths, including empty and unnamed packages
• record per-package production counts, Rust public visibility, TypeScript exports, mdbase caller references, and production dead-code locations
• retain cycle and per-file checks while excluding conventional Rust test modules from production counts

Counts are review controls, not minimization goals. Evidence-backed increases remain possible through an explicit configuration change.

Reviewed baseline

• 663 production files
• 1,375 relative imports
• 24 npm/Cargo package paths
• 3,090 conservative Rust public visibility references
• 2,290 TypeScript export references
• 16 mdbase::Collection references
• 1 TypedCollection reference
• 4 production files containing dead-code references

Verification

• 13 focused architecture-checker tests
• pnpm check:architecture
• pnpm typecheck
• pnpm test
• pnpm check:workspace-pins with the sibling specification at the currently pinned 362953e

The merged-spec checkout intentionally exposes the separately characterized six resolver failures and is not changed by this guardrail PR.

Review

Five adversarial correction rounds covered Rust test classification, same-line/public-field counts, empty named/unnamed npm packages, empty Cargo crates, malformed/missing budget validation, and aggregate npm/Cargo inventory. Final result: ACCEPT.

No product, protocol, request-path, dependency, schema, migration, or lockfile changes.