feat: Phase 0 of hexagonal refactor — ADR 0016, core scaffold, depguard rules

Problem: the hexagonal-architecture plan (plans/2026-08-15-hexagonal-
architecture.md) needs its foundation — an accepted ADR, the target
directory tree, and machine-checked dependency rules — before any
service extraction starts. Also folds the four outstanding review
findings (F3.1/F5/F6/F7) into the plan: ObservationService owns the
bounded probe-concurrency contract (scheduler.go:133), Phase 9 gates
ExecutionService+PolicyService ≥ 90% with a gating-matrix test,
per-phase abort criteria, and the §3.2 internal/config note.

Change:
- docs/adr/0016-hexagonal-ports-adapters.md records context, decision,
  and consequences of the ports & adapters migration.
- internal/domain → internal/core/domain (mechanical import rewrite,
  20 files), new internal/core/{ports,app}, internal/adapters trees
  with package docs.
- .golangci.yml: depguard rules for §3.1 (core purity, no agent-client
  tech in core, nomos isolation — the nomos rules self-activate when
  internal/nomos exists in Phase 8). Config migrated to golangci-lint
  v2 format so it loads at all (the v1 config errored under v2, masked
  by CI's advisory continue-on-error). Verified depguard fires on a
  planted openai-go import in internal/core/app.
- CONTRIBUTING.md layout section now shows the core/adapters tree.

Risk: import path churn is mechanical and tests pass unchanged; the
lint config migration surfaces the pre-existing 400-issue baseline
(advisory in CI, unchanged policy) — new/moved packages lint clean.

Verification: go vet ./..., make test (race, core/domain at 100%
coverage), make generate-check, golangci-lint on internal/core/... and
internal/adapters/... — 0 issues; depguard violation probe confirmed.

CONTRIBUTING.md

@@ -68,6 +68,15 @@ cmd/oikos/          Single-binary entry point
 cmd/nomos/          Nomos MCP client gateway
 cmd/webhook/        Gitea deploy-webhook receiver (push-to-deploy on mac-mini)
 internal/           All Go packages
+  core/             Hexagon core ([ADR 0016](docs/adr/0016-hexagonal-ports-adapters.md)):
+                    domain/ (pure model, stdlib only), ports/ (driven-port
+                    interfaces), app/ (use-case services) — populated by the
+                    phased refactor (plans/2026-08-15-hexagonal-architecture.md);
+                    core may not import adapters, enforced by depguard
+  adapters/         Ports' implementations (postgres, ssh, probes, remote,
+                    secrets, events) + driving adapters (httpapi, mcpserver,
+                    scheduler, execworker, cli) — scaffolded; packages move
+                    here phase by phase
   httpapi/          REST + MCP server (OpenAPI-generated)
   mcp/              MCP tool implementations
   db/               Connection pool, migrations, seeds, sqlc queries
@@ -76,7 +85,6 @@ internal/           All Go packages
   learning/         Pattern recognition, anomaly detection
   policy/           Risk classifier
   secrets/          Infisical + SOPS backend
-  domain/           Core types: entities, approvals, signals, patterns
   ontology/         Type hierarchy, relationship validation
   knowledge/        Knowledge YAML seed ingestion
 web/                Control-room SPA (Svelte 5) — standalone, not embedded