feat: Phase 0 of hexagonal refactor — ADR 0016, core scaffold, depguard rules

Problem: the hexagonal-architecture plan (plans/2026-08-15-hexagonal-
architecture.md) needs its foundation — an accepted ADR, the target
directory tree, and machine-checked dependency rules — before any
service extraction starts. Also folds the four outstanding review
findings (F3.1/F5/F6/F7) into the plan: ObservationService owns the
bounded probe-concurrency contract (scheduler.go:133), Phase 9 gates
ExecutionService+PolicyService ≥ 90% with a gating-matrix test,
per-phase abort criteria, and the §3.2 internal/config note.

Change:
- docs/adr/0016-hexagonal-ports-adapters.md records context, decision,
  and consequences of the ports & adapters migration.
- internal/domain → internal/core/domain (mechanical import rewrite,
  20 files), new internal/core/{ports,app}, internal/adapters trees
  with package docs.
- .golangci.yml: depguard rules for §3.1 (core purity, no agent-client
  tech in core, nomos isolation — the nomos rules self-activate when
  internal/nomos exists in Phase 8). Config migrated to golangci-lint
  v2 format so it loads at all (the v1 config errored under v2, masked
  by CI's advisory continue-on-error). Verified depguard fires on a
  planted openai-go import in internal/core/app.
- CONTRIBUTING.md layout section now shows the core/adapters tree.

Risk: import path churn is mechanical and tests pass unchanged; the
lint config migration surfaces the pre-existing 400-issue baseline
(advisory in CI, unchanged policy) — new/moved packages lint clean.

Verification: go vet ./..., make test (race, core/domain at 100%
coverage), make generate-check, golangci-lint on internal/core/... and
internal/adapters/... — 0 issues; depguard violation probe confirmed.

internal/core/domain/errors.go

@@ -0,0 +1,22 @@
+package domain
+
+import "errors"
+
+// Sentinel errors. Used throughout the codebase for typed error handling.
+// The API middleware maps these to HTTP status codes (SG11).
+var (
+	ErrNotFound          = errors.New("entity not found")
+	ErrInvalidTransition = errors.New("invalid lifecycle transition")
+	ErrApprovalRequired  = errors.New("operator approval required")
+	ErrAutonomyBlocked   = errors.New("autonomy policy blocks this action")
+	ErrConflict          = errors.New("concurrent modification conflict")
+	ErrCircuitOpen       = errors.New("circuit breaker open for target")
+	ErrAbstractType      = errors.New("cannot instantiate abstract entity type")
+	ErrInvalidEdge       = errors.New("relationship endpoint type mismatch")
+	ErrCardinality       = errors.New("relationship cardinality violation")
+	ErrSeedHashMismatch  = errors.New("seed content hash mismatch")
+	ErrAlreadyExists     = errors.New("entity already exists")
+	ErrQuarantined       = errors.New("pattern is quarantined")
+	ErrSkillDeprecated   = errors.New("skill is deprecated")
+	ErrInvalidInput      = errors.New("invalid input")
+)