ci: import-boundary law + CI workflow (P0 complete)

Boundary script enforces contracts<testkit<service (catches from/side-effect/
dynamic/require imports); wired into pnpm test + CI. CI: install --frozen-lockfile
-> boundary -> typecheck -> build -> test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/import-boundary.test.ts

@@ -0,0 +1,9 @@
+import { describe, it, expect } from 'vitest';
+// @ts-expect-error — plain ESM script, no type declarations
+import { findBoundaryViolations } from '../scripts/check-import-boundary.mjs';
+
+describe('import-boundary law', () => {
+  it('no lower layer imports a higher layer (contracts < testkit < service)', () => {
+    expect(findBoundaryViolations()).toEqual([]);
+  });
+});