fix(design): add configurable architecture boundaries

[alxxjohn]

Summary

Adds configurable design-boundary enforcement for Codeguard, with support for keeping longer architecture policies in a
separate .codeguard/design_rules.yml file instead of bloating the main codeguard.yml.

This implements eight design boundary checks:

• Layer dependency boundaries
• Domain boundaries
• Cross-domain data ownership boundaries
• Capability/import restrictions
• Public surface / private module import boundaries
• Production code importing test-only code
• Entrypoint reachability
• Stability direction checks

Details

• Added checks.design_rules_file support.
• Auto-discovers .codeguard/design_rules.yml or .codeguard/design_rules.yaml.
• Allows inline checks.design_rules fields to override matching external policy fields.
• Preserves explicit false, 0, and empty-list values from external and inline design policies.
• Adds schema/config types for layers, domains, capabilities, public surfaces, production/test isolation, reachability, and
  stability.
• Extends Go, TypeScript/JavaScript, Python, Rust, Java, and C++ design graphs to retain source import details needed for
  boundary findings.
• Adds rule catalog metadata and fix templates for the new design rules.
• Adds examples/design_rules.yml as a standalone policy template.
• Updates docs for external design rules and all new boundary policies.
• Adds test coverage for config loading, validation, path matching, architecture boundaries, encapsulation boundaries,
  reachability, stability, and supported-language capability imports.

Verification

• go test focused design/config/rules packages passed.
• Full make ci passed on the feature branch.
• Remaining Codeguard self-scan warnings are pre-existing in tests/checks/report_features_test.go and unrelated to this
  change.