[rc1-prep] Lint-enforced principles: add principles-to-enforcement mapping table + §6 depguard rule

[trilamsr]

O7 supporting KPI: ≥6 of 15 principles enforced via golangci-lint.

Current state. Measured 4 of 16 numbered principles strictly
lint-enforced (§3, §8, §9, §13). Five further principles are
enforced by Makefile-driven scripts but not by golangci-lint.

Remediation.

1. Add a principles-to-enforcement mapping table to
   PRINCIPLES.md so the next O7 audit
   reads from one place.
2. Lift §6 (internal/ → pkg/ movement) to a depguard rule with
   an allowlist for existing pkg/... paths — gets us from 4 → 5.
3. Add an explicit principles→gosec/govet linkage in §1 (panic
   recovery) — gets us from 5 → 6.

Effort: M (table edit is S; depguard rule is M because the
allowlist must enumerate existing pkg/ paths).

Audit source: docs/v1-rc1-governance-gaps.md §2.