B9 — CI boundary guard: keep the experience out of core internals

[KrasForge]

Part of EPIC B0 #293

Depends on: B1 #294 (authoring); B4 #297, B5 #298, B6 #299, B7 #300 (enforcement)

Context

The guard is what proves the API is real and keeps it real. Without it the boundary rots within a week. Author the rule early in warn mode; flip to error once B4–B7 land.

Scope — in

• ESLint no-restricted-imports / dependency-cruiser rule: feature-layer code may import only the public ModuloCoreAPI barrel — never core internals.
• CI gate wired into the existing pipeline.

Scope — out

• No changes to what the API exposes (that is B1).

Acceptance

• CI fails on a deliberately-added disallowed import.
• CI passes on the post-B7 codebase.
• Rule documented; rationale links B8 B8 — Decision record: core keeps first-class note types (non-goal guard) #301.