feat: Phase 0 of hexagonal refactor — ADR 0016, core scaffold, depguard rules

Problem: the hexagonal-architecture plan (plans/2026-08-15-hexagonal-
architecture.md) needs its foundation — an accepted ADR, the target
directory tree, and machine-checked dependency rules — before any
service extraction starts. Also folds the four outstanding review
findings (F3.1/F5/F6/F7) into the plan: ObservationService owns the
bounded probe-concurrency contract (scheduler.go:133), Phase 9 gates
ExecutionService+PolicyService ≥ 90% with a gating-matrix test,
per-phase abort criteria, and the §3.2 internal/config note.

Change:
- docs/adr/0016-hexagonal-ports-adapters.md records context, decision,
  and consequences of the ports & adapters migration.
- internal/domain → internal/core/domain (mechanical import rewrite,
  20 files), new internal/core/{ports,app}, internal/adapters trees
  with package docs.
- .golangci.yml: depguard rules for §3.1 (core purity, no agent-client
  tech in core, nomos isolation — the nomos rules self-activate when
  internal/nomos exists in Phase 8). Config migrated to golangci-lint
  v2 format so it loads at all (the v1 config errored under v2, masked
  by CI's advisory continue-on-error). Verified depguard fires on a
  planted openai-go import in internal/core/app.
- CONTRIBUTING.md layout section now shows the core/adapters tree.

Risk: import path churn is mechanical and tests pass unchanged; the
lint config migration surfaces the pre-existing 400-issue baseline
(advisory in CI, unchanged policy) — new/moved packages lint clean.

Verification: go vet ./..., make test (race, core/domain at 100%
coverage), make generate-check, golangci-lint on internal/core/... and
internal/adapters/... — 0 issues; depguard violation probe confirmed.

internal/core/domain/domain_test.go

@@ -0,0 +1,139 @@
+package domain
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestIsNil(t *testing.T) {
+	cases := []struct {
+		name string
+		u    UUID
+		want bool
+	}{
+		{"empty string", UUID(""), true},
+		{"single char", UUID("x"), false},
+		{"uuid string", UUID("550e8400-e29b-41d4-a716-446655440000"), false},
+		{"nil literal", UUID(""), true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got := c.u.IsNil()
+			if got != c.want {
+				t.Errorf("UUID(%q).IsNil() = %v, want %v", c.u, got, c.want)
+			}
+		})
+	}
+}
+
+func TestCanTransition(t *testing.T) {
+	type tc struct {
+		name string
+		from string
+		to   string
+		want bool
+	}
+	var cases []tc
+
+	for from, targets := range ValidSignalTransitions {
+		for _, to := range targets {
+			cases = append(cases, tc{from + "->" + to, from, to, true})
+		}
+	}
+
+	disallowed := []tc{
+		{"raised->raised", SignalRaised, SignalRaised, false},
+		{"resolved->raised", SignalResolved, SignalRaised, false},
+		{"failed->raised", SignalFailed, SignalRaised, false},
+		{"acknowledged->raised", SignalAcknowledged, SignalRaised, false},
+		{"muted->resolved", SignalMuted, SignalResolved, false},
+		{"acting->acknowledged", SignalActing, SignalAcknowledged, false},
+	}
+	cases = append(cases, disallowed...)
+
+	cases = append(cases,
+		tc{"unknown source", "nonexistent", SignalRaised, false},
+		tc{"unknown target", SignalRaised, "nonexistent", false},
+	)
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			s := &Signal{State: c.from}
+			got := s.CanTransition(c.to)
+			if got != c.want {
+				t.Errorf("CanTransition(%q -> %q) = %v, want %v", c.from, c.to, got, c.want)
+			}
+		})
+	}
+}
+
+func TestSentinelErrors(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		msg  string
+	}{
+		{"ErrNotFound", ErrNotFound, "entity not found"},
+		{"ErrInvalidTransition", ErrInvalidTransition, "invalid lifecycle transition"},
+		{"ErrApprovalRequired", ErrApprovalRequired, "operator approval required"},
+		{"ErrAutonomyBlocked", ErrAutonomyBlocked, "autonomy policy blocks this action"},
+		{"ErrConflict", ErrConflict, "concurrent modification conflict"},
+		{"ErrCircuitOpen", ErrCircuitOpen, "circuit breaker open for target"},
+		{"ErrAbstractType", ErrAbstractType, "cannot instantiate abstract entity type"},
+		{"ErrInvalidEdge", ErrInvalidEdge, "relationship endpoint type mismatch"},
+		{"ErrCardinality", ErrCardinality, "relationship cardinality violation"},
+		{"ErrSeedHashMismatch", ErrSeedHashMismatch, "seed content hash mismatch"},
+		{"ErrAlreadyExists", ErrAlreadyExists, "entity already exists"},
+		{"ErrQuarantined", ErrQuarantined, "pattern is quarantined"},
+		{"ErrSkillDeprecated", ErrSkillDeprecated, "skill is deprecated"},
+		{"ErrInvalidInput", ErrInvalidInput, "invalid input"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if c.err == nil {
+				t.Fatal("sentinel error is nil")
+			}
+			if !errors.Is(c.err, c.err) {
+				t.Errorf("errors.Is failed for %s", c.name)
+			}
+			if c.err.Error() != c.msg {
+				t.Errorf("Error() = %q, want %q", c.err.Error(), c.msg)
+			}
+		})
+	}
+}
+
+func TestSignalTransitionsComplete(t *testing.T) {
+	// Non-terminal states must be keys in ValidSignalTransitions.
+	// SignalResolved is a terminal state (no outgoing transitions) and is
+	// intentionally absent from the map.
+	nonTerminal := []string{
+		SignalRaised,
+		SignalAcknowledged,
+		SignalActing,
+		SignalMuted,
+		SignalFailed,
+	}
+	for _, state := range nonTerminal {
+		targets, ok := ValidSignalTransitions[state]
+		if !ok {
+			t.Errorf("non-terminal state %q missing from ValidSignalTransitions", state)
+			continue
+		}
+		if len(targets) == 0 {
+			t.Errorf("state %q maps to empty transition list", state)
+		}
+	}
+
+	// Resolved is terminal: it should not appear as a source key.
+	if _, ok := ValidSignalTransitions[SignalResolved]; ok {
+		t.Errorf("terminal state %q should not have outgoing transitions", SignalResolved)
+	}
+
+	// No state anywhere in the map may map to nil/empty.
+	for state, targets := range ValidSignalTransitions {
+		if len(targets) == 0 {
+			t.Errorf("state %q maps to empty/nil transition list", state)
+		}
+	}
+}