test(architecture): prove merged pkgviz on Eddy

[artiphishle]

Summary

Add the real Eddy end-to-end proof for the canonical SourceGraph + Rules Architecture pipeline used by PKGViz #262.

• run the exact merged PKGViz 0.8.3 source at 840ffba836939caaa25d3da94a1f3b1e8a0dd8b4
• consume the released owner stack from the PKGViz lockfile
• analyze the real Java repository once through PKGViz
• keep architecture detection separate from enforcement
• explicitly select the hexagonal model target for evaluation
• keep the proof advisory/non-blocking
• assert canonical SourceGraph retention, detection candidates/evidence/contradictions/capability limits, explicit target evaluation, generic Rules output, and coexistence of the cycle rule
• upload the generated pkgviz-audit.json as CI evidence

No Java-specific architecture path is added.

Proof result

GitHub Actions run 37098856993 passed.

Observed from the real Eddy Audit:

• hexagonal: confidence 0.655, score 66, 21 supporting evidence items, 323 role assignments
• clean: confidence 0.641, score 64, 21 supporting evidence items, 278 role assignments
• layered: confidence 0.548, score 55, 4 supporting evidence items, 84 role assignments
• onion: confidence 0.529, score 53, 4 supporting evidence items, 101 role assignments
• no unavailable capabilities were reported
• explicit target remained hexagonal
• generic Rules evaluation completed with zero diagnostics/findings for this target
• cyclic-dependencies coexisted in the same Audit and passed with advisory policy
• Audit artifact: eddy-pkgviz-architecture-audit

Required skills

This repository currently has no AGENTS.md or .agents/skills/ instructions.

Refs #8
Closes ankhorage/atlas#262
Refs ankhorage/dependency-graph#24

The separate npm-registry publication requirement tracked by Eddy #8 is not claimed by this PR.