fix(recorders): a flat dependency graph is not a ranking (#2556)

[squid-protocol]

Closes #2556.

The defect

"Top 5 Structural Pillars (Highest 'Imported By' / Blast Radius)" sorts by popularity and takes the
first five, with no check that the maximum is above zero:

pillars = sorted(parsed_files, key=lambda x: x.get("telemetry", {}).get("popularity", 0), reverse=True)[:5]

On a repo with no resolvable internal imports that emits five files with 0 inbound connections
under a heading calling them "the most interconnected files". The scan on the issue listed
Changes.md, MAINTAINERS.md and README.md as the load-bearing infrastructure of a COBOL
application. This brief is written to be consumed by an LLM, which will repeat the ranking as fact.

What this changes

Both sections, not one. The neighbouring "Top 5 Orchestrators" list has the identical defect,
which the issue does not mention — with no resolvable imports anywhere it calls five files with 0
outbound dependencies "highly coupled and fragile to API changes". Guarding only the pillar list
would have left the same false claim two paragraphs down.

Each replacement says what a flat graph actually means — either the codebase genuinely has no
internal dependency structure (scripts, documents, configuration rather than a coupled system), or
its import style is one the engine does not resolve for that language — and tells the reader not to
infer that any file is load-bearing. Stating the finding is more useful than silently emitting
nothing, given the audience.

The headings stay, so the brief's section structure is unchanged.

The issue's secondary question

Why are documentation files surfacing first among all-zero candidates? Is it alphabetical
tie-breaking?

No — it's scan order. Python's sorted is stable, so when every key is 0 the input order is
preserved untouched. Nothing is choosing documentation; it just tends to come first.

Scope note

The trigger is rarer than when this was filed: #2668 (merged as #2685) fixed relative imports that
carry an extension, which was why whole javascript / shell / yaml / powershell ecosystems presented
as flat graphs. A repo with genuinely no internal imports still reaches this path, so the guard is
still needed — but expect it to fire less often than the issue implies.

Verification

• Full suite 7467 passed; audit_check all clear.
• 3 new tests; the two negative ones fail on origin/main, and the third proves the guard fires
  only on an all-zero graph — a single connection anywhere restores both rankings.
• No golden-master impact: the crucible fixtures are the audit JSON, which carries no LLM brief.
  Recorder layer only, so no bless and no corpus rebless.
• One ruff baseline key rekeyed 1018 → 1049 by audit_check.py --regenerate, which classified it
  as a pure line-shift (the SIM102 finding from Ruff SIM102: remaining nested-if findings (llm_recorder, security_lens, network/binary tools) #493, untouched by this PR).

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab