feat(governance): CODEOWNERS + lint-enforced principles + depguard

[trilamsr]

Summary

Two governance gaps from the v1.0-rc1 audit (docs/v1-rc1-governance-gaps.md) closed in one PR:

#322 — CODEOWNERS coverage (0% → ~95%)

CODEOWNERS previously covered only governance files + a handful of CI / supply-chain anchors. Zero top-level source directories had a matching rule, so the O7 supporting KPI (CODEOWNERS covers ≥80% of code paths) measured 0%.

• Added a * default-owner line so anything not matched downstream still routes to @TraceCoreAI/core.
• Added directory-scoped rules for every top-level source dir: module/, components/, internal/, install/, docs/, scripts/, tools/, bench/, python/.
• Documented the layering convention at the top of the file (catch-all → directory → file-scoped; matched-last semantics). Sub-team splits land later when a second non-author maintainer joins, per docs/maintainership.md § "Proposed: bar to join".

Note: the issue body lists dist/ as a top-level dir but no such dir exists in the repo today (RFC-0013 dist artifacts live under install/). internal/ and tools/ exist and are included instead.

#323 — Lint-enforced principles (4/16 → 5/16)

Two complementary changes:

1. PRINCIPLES.md gains an Enforcement map table. Every numbered principle (§1–§16) maps to its enforcement mechanism (lint rule / scripted gate / cultural). Closes the audit gap "the principles-to-enforcement mapping is the missing artifact" so the next O7 audit reads from one place rather than rediscovering the topology. Includes a 3-step rubric for what to do when a new violation lands: add lint rule → add scripted gate → update table.

2. .golangci.yml gains a pkg-private depguard rule expressing PRINCIPLES §6 ("defaults bias toward private"). New module/pkg/... subpaths fail lint unless explicitly allowlisted. The current allowlist enumerates the 6 RFC-0013-ratified paths (nccl, patterns, replay, runtime, selftel, testutil). Adding a sibling now requires an RFC + an explicit entry — moving §6 from cultural to lint-enforced.

The third remediation in the audit (gosec linkage to §1 for "5 → 6") is captured in the table's §1 row as partial lint but the upgrade-path to strict lint is left as follow-up rather than padded in here — gosec is already enabled and the linkage is the documentation, not a new rule.

Governance: CODEOWNERS now covers every top-level source directory
(module/, components/, internal/, install/, docs/, scripts/, tools/,
bench/, python/) — lifts measured O7 coverage from 0% to ~95%.
PRINCIPLES.md gains an Enforcement map table linking each numbered
principle to its lint rule / scripted gate. A new `pkg-private`
depguard rule lifts PRINCIPLES §6 to lint-enforced: new `pkg/`
subpaths require an RFC + explicit allowlist entry.

Validation

• cd module && go tool golangci-lint run ./... — 34 issues (identical to main; pre-existing testifylint / exhaustive / etc., none introduced by this PR).
• go tool golangci-lint run ./... (root) — 0 issues.
• scripts/doc-check.sh — clean.
• Pre-commit make check ran on both commits — passed (golangci-lint, vet, mod-verify, attribute-namespace-check, no-autoupdate-check).
• Negative test for the depguard rule: synthesized a module/pkg/foobar import in a transient throwaway file; lint fired with the expected PRINCIPLES §6: new \pkg/` subpaths require an RFC ...` message. Throwaway cleaned up.

Test plan

• cd module && go tool golangci-lint run ./... shows no new issues vs main.
• Root go tool golangci-lint run ./... clean.
• scripts/doc-check.sh clean.
• depguard rule fires on a synthesized new module/pkg/foobar import.
• depguard rule stays silent on every existing module/pkg/... caller.

Closes #322, #323.