feat: Phase 0 of hexagonal refactor — ADR 0016, core scaffold, depguard rules

Problem: the hexagonal-architecture plan (plans/2026-08-15-hexagonal-
architecture.md) needs its foundation — an accepted ADR, the target
directory tree, and machine-checked dependency rules — before any
service extraction starts. Also folds the four outstanding review
findings (F3.1/F5/F6/F7) into the plan: ObservationService owns the
bounded probe-concurrency contract (scheduler.go:133), Phase 9 gates
ExecutionService+PolicyService ≥ 90% with a gating-matrix test,
per-phase abort criteria, and the §3.2 internal/config note.

Change:
- docs/adr/0016-hexagonal-ports-adapters.md records context, decision,
  and consequences of the ports & adapters migration.
- internal/domain → internal/core/domain (mechanical import rewrite,
  20 files), new internal/core/{ports,app}, internal/adapters trees
  with package docs.
- .golangci.yml: depguard rules for §3.1 (core purity, no agent-client
  tech in core, nomos isolation — the nomos rules self-activate when
  internal/nomos exists in Phase 8). Config migrated to golangci-lint
  v2 format so it loads at all (the v1 config errored under v2, masked
  by CI's advisory continue-on-error). Verified depguard fires on a
  planted openai-go import in internal/core/app.
- CONTRIBUTING.md layout section now shows the core/adapters tree.

Risk: import path churn is mechanical and tests pass unchanged; the
lint config migration surfaces the pre-existing 400-issue baseline
(advisory in CI, unchanged policy) — new/moved packages lint clean.

Verification: go vet ./..., make test (race, core/domain at 100%
coverage), make generate-check, golangci-lint on internal/core/... and
internal/adapters/... — 0 issues; depguard violation probe confirmed.

.golangci.yml

@@ -1,41 +1,89 @@
-# golangci-lint configuration for Oikos
+# golangci-lint v2 configuration for Oikos
 # Docs: https://golangci-lint.run/usage/configuration/
+# Default-enabled linters (errcheck, govet, ineffassign, staticcheck, unused)
+# are not listed below. gosimple/typecheck were absorbed into staticcheck in v2.
+version: "2"
 run:
-  timeout: 5m
   tests: true
-
 linters:
   enable:
-    - govet        # go vet
-    - staticcheck  # advanced static analysis
-    - ineffassign  # detect ineffectual assignments
-    - unused       # find unused identifiers
-    - errcheck     # check for unchecked errors
-    - gosimple     # simplifications
-    - typecheck    # standard type checking
-    - misspell     # find commonly misspelled English words in comments
-    - revive       # fast, configurable linter (replaces golint)
-
-linters-settings:
-  errcheck:
-    # Allow unchecked errors on common Close/Flush patterns (deferred cleanup)
-    exclude-functions:
-      - (io.Closer).Close
-      - (*os.File).Close
-
+    - depguard
+    - misspell
+    - revive
+  settings:
+    depguard:
+      # ADR 0016 dependency rules. Rules only constrain files that exist:
+      # internal/core is live since Phase 0 (domain moved); internal/nomos
+      # and its bans activate in Phase 8; full audit at Phase 9.
+      rules:
+        core-no-agent-tech:
+          files:
+            - "**/internal/core/**"
+          deny:
+            - pkg: github.com/dtoro/oikos/internal/nomos
+              desc: core never links agent-client packages (ADR 0016 §3.1 rule 3)
+            - pkg: github.com/dtoro/oikos/internal/nomos/**
+              desc: core never links agent-client packages (ADR 0016 §3.1 rule 3)
+            - pkg: github.com/openai/openai-go
+              desc: core never links the LLM SDK — nomos is an external client
+            - pkg: github.com/openai/openai-go/**
+              desc: core never links the LLM SDK — nomos is an external client
+            - pkg: github.com/modelcontextprotocol/go-sdk
+              desc: core never links MCP packages — mcpserver is a driving adapter
+            - pkg: github.com/modelcontextprotocol/go-sdk/**
+              desc: core never links MCP packages — mcpserver is a driving adapter
+        core-purity:
+          files:
+            - "**/internal/core/**"
+          deny:
+            - pkg: github.com/dtoro/oikos/internal/adapters
+              desc: core must not import adapters — depend on core/ports instead
+            - pkg: github.com/dtoro/oikos/internal/adapters/**
+              desc: core must not import adapters — depend on core/ports instead
+            - pkg: github.com/dtoro/oikos/cmd
+              desc: core must not import composition roots
+            - pkg: github.com/dtoro/oikos/cmd/**
+              desc: core must not import composition roots
+        nomos-isolation:
+          files:
+            - "**/internal/nomos/**"
+          deny:
+            - pkg: github.com/dtoro/oikos/internal/core
+              desc: nomos must not import core — consume oikos via MCP/REST
+            - pkg: github.com/dtoro/oikos/internal/core/**
+              desc: nomos must not import core — consume oikos via MCP/REST
+            - pkg: github.com/dtoro/oikos/internal/adapters
+              desc: nomos must not import adapters — consume oikos via MCP/REST
+            - pkg: github.com/dtoro/oikos/internal/adapters/**
+              desc: nomos must not import adapters — consume oikos via MCP/REST
+    errcheck:
+      # Allow unchecked errors on common Close/Flush patterns (deferred cleanup)
+      exclude-functions:
+        - (io.Closer).Close
+        - (*os.File).Close
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - errcheck
+        path: _test\.go
+      - linters:
+          - all
+        path: internal/httpapi/gen/
+      - linters:
+          - all
+        path: internal/db/sqlcgen/
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  # Exclude generated code
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-    - path: internal/httpapi/gen/
-      linters:
-        - all
-    - path: internal/db/sqlcgen/
-      linters:
-        - all
-  # Don't auto-exclude common patterns
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$