feat: Phase 0 of hexagonal refactor — ADR 0016, core scaffold, depguard rules

Problem: the hexagonal-architecture plan (plans/2026-08-15-hexagonal-
architecture.md) needs its foundation — an accepted ADR, the target
directory tree, and machine-checked dependency rules — before any
service extraction starts. Also folds the four outstanding review
findings (F3.1/F5/F6/F7) into the plan: ObservationService owns the
bounded probe-concurrency contract (scheduler.go:133), Phase 9 gates
ExecutionService+PolicyService ≥ 90% with a gating-matrix test,
per-phase abort criteria, and the §3.2 internal/config note.

Change:
- docs/adr/0016-hexagonal-ports-adapters.md records context, decision,
  and consequences of the ports & adapters migration.
- internal/domain → internal/core/domain (mechanical import rewrite,
  20 files), new internal/core/{ports,app}, internal/adapters trees
  with package docs.
- .golangci.yml: depguard rules for §3.1 (core purity, no agent-client
  tech in core, nomos isolation — the nomos rules self-activate when
  internal/nomos exists in Phase 8). Config migrated to golangci-lint
  v2 format so it loads at all (the v1 config errored under v2, masked
  by CI's advisory continue-on-error). Verified depguard fires on a
  planted openai-go import in internal/core/app.
- CONTRIBUTING.md layout section now shows the core/adapters tree.

Risk: import path churn is mechanical and tests pass unchanged; the
lint config migration surfaces the pre-existing 400-issue baseline
(advisory in CI, unchanged policy) — new/moved packages lint clean.

Verification: go vet ./..., make test (race, core/domain at 100%
coverage), make generate-check, golangci-lint on internal/core/... and
internal/adapters/... — 0 issues; depguard violation probe confirmed.

internal/core/domain/signal.go

@@ -0,0 +1,65 @@
+package domain
+
+import "time"
+
+// Signal is an attention record — something the lab noticed that needs
+// attention and possibly action. Dual entity: has an entities row + a
+// signals table row for indexed querying.
+type Signal struct {
+	EntityID        UUID
+	Kind            string
+	Severity        string
+	TargetEntityID  UUID
+	CheckID         UUID
+	Evidence        string
+	LikelyCause     string
+	State           string
+	OccurrenceCount int
+	FirstSeenAt     time.Time
+	LastSeenAt      time.Time
+	FlapCount       int
+	HoldDownUntil   *time.Time
+	MuteUntil       *time.Time
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+// Signal lifecycle states (see lifecycle_defs in seeds/ontology.yaml).
+const (
+	SignalRaised       = "raised"
+	SignalAcknowledged = "acknowledged"
+	SignalActing       = "acting"
+	SignalMuted        = "muted"
+	SignalResolved     = "resolved"
+	SignalFailed       = "failed"
+)
+
+// Signal severities.
+const (
+	SeverityInfo     = "info"
+	SeverityWarning  = "warning"
+	SeverityCritical = "critical"
+)
+
+// ValidSignalTransitions defines legal state transitions.
+var ValidSignalTransitions = map[string][]string{
+	SignalRaised:       {SignalAcknowledged, SignalMuted, SignalResolved},
+	SignalAcknowledged: {SignalActing, SignalResolved, SignalMuted},
+	SignalActing:       {SignalResolved, SignalRaised, SignalFailed},
+	SignalFailed:       {SignalAcknowledged},
+	SignalMuted:        {SignalRaised},
+}
+
+// CanTransition returns true if from→to is a legal signal state transition.
+func (s *Signal) CanTransition(to string) bool {
+	allowed, ok := ValidSignalTransitions[s.State]
+	if !ok {
+		return false
+	}
+	for _, a := range allowed {
+		if a == to {
+			return true
+		}
+	}
+	return false
+}