chore: Phase 9 completion - depguard audit, docs, minor bump

Final phase of the hexagonal architecture refactor (plans/2026-08-15-hexagonal-architecture.md). Verifies depguard rules, updates CONTRIBUTING.md to reflect final architecture, marks plan as complete, and bumps minor version to 0.34.0.

CONTRIBUTING.md

@@ -51,24 +51,27 @@ cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/           All Go packages
   core/             Hexagon core ([ADR 0016](docs/adr/0016-hexagonal-ports-adapters.md)):
                     domain/ (pure model, stdlib only), ports/ (driven-port
-                    interfaces), app/ (use-case services) — populated by the
-                    phased refactor (plans/2026-08-15-hexagonal-architecture.md);
-                    core may not import adapters, enforced by depguard
-  adapters/         Ports' implementations (postgres, ssh, probes, remote,
-                    secrets, events) + driving adapters (httpapi, mcpserver,
-                    scheduler, execworker, cli) — scaffolded; packages move
-                    here phase by phase
-  httpapi/          REST + MCP server (OpenAPI-generated)
-  mcp/              MCP tool implementations
-  db/               (moved) → internal/adapters/postgres: pool, migrations,
-                     seeds, sqlc queries — package still named `db` until
-                     the Phase 3 repository split
-  scheduler/        Observe loop, probes, signals
-  actuator/         SSH execution
-  learning/         Pattern recognition, anomaly detection
-  policy/           Risk classifier
-  secrets/          Infisical + SOPS backend
-  ontology/         Type hierarchy, relationship validation
+                    interfaces), app/ (use-case services — EntityService,
+                    RelationshipService, SignalService, ObservationService,
+                    KnowledgeService, LearningService, etc.) — populated by
+                    the phased refactor; core may not import adapters,
+                    enforced by depguard (verified Phase 9 audit)
+  adapters/         Ports' implementations: postgres/ (pool, migrations, seeds,
+                    sqlcgen, repos — EntityRepo, RelRepo, OntologyRepo,
+                    EntityReader, SignalRepo, MetricsRepo, etc.),
+                    ssh/ (CommandExecutor via actuator),
+                    remote/ (TargetResolver via internal/remote),
+                    probes/ (Checker implementations per probe kind:
+                    HTTP, TCP, ping, DNS, SSH)
+  httpapi/          REST server (OpenAPI-generated) — driving adapter
+  mcp/              MCP tool implementations — driving adapter
+  scheduler/        Observe loop, coverage sweep — driving adapter (moves
+                    to ObservationService/SignalService in Phase 5)
+  execworker/       Execution worker — driving adapter
+  actuator/         SSH execution — consumed by adapters/ssh
+  remote/           Target resolution — consumed by adapters/remote
+  audit/            Audit report helpers
+  observability/    Event/Audit recorder helpers
   knowledge/        Knowledge YAML seed ingestion
 api/openapi.yaml    API contract — the source of truth for endpoints
 migrations/         Forward-only SQL migrations (TimescaleDB)