feat: add operability, design, and delivery governance checks

[alxxjohn]

Summary

Adds the next production-readiness rule set for CodeGuard, focused on operability, local abstraction quality, delivery safety,
and governance.

This branch expands CodeGuard beyond code-quality scanning into readiness review by adding new checks for:

• Observability and operational readiness
• Service ownership and runbook metadata
• Local abstraction/design quality
• Environment branching and configuration leakage
• Delivery and rollout safety
• CI/CD governance
• Supply-chain provenance expectations

Major changes

• Added observability checks for:

  • unstructured logs
  • errors without useful context
  • sensitive data in logs
  • high-cardinality metric labels
  • missing critical-path instrumentation
  • log-and-ignore failure handling
  • shallow health checks

• Added operations checks for:

  • missing service ownership
  • missing runbook metadata for critical paths

• Added design checks for:

  • shallow modules
  • excessive public surface
  • pass-through abstractions
  • configuration leakage
  • temporal coupling
  • duplicated business knowledge
  • infrastructure type leakage
  • persistence model leakage
  • domain logic in handlers/controllers

• Added delivery governance checks for:

  • missing required CI gates
  • mutable deployment references
  • missing rollback strategy
  • unsafe migration ordering
  • high-risk changes without kill switches
  • missing post-deploy verification
  • missing artifact provenance
  • environment-specific branching in source

• Updated docs/rule metadata so the new check families and rule IDs are visible to users.

Dogfooding / cleanup

This branch also dogfoods the new strict checks against CodeGuard itself.

Instead of relaxing CodeGuard policy to make the branch pass, we reverted the policy-tuning commit and refactored concrete
hotspots:

• split large quality precision code into smaller units
• consolidated operability check packages to reduce dependency fan-in
• extracted shared path-pattern matching
• refactored policy profile comparison rendering
• fixed strict lint findings directly

Validation

• make codeguard-ci passes
• make ci passes
• Branch is clean and pushed