Add an architecture edge ratchet and waiting-state tokens

Why: New cross-layer imports and unused exports could land unnoticed, and confirm-waiting reused the success color.
Evidence: bash scripts/lint-boundaries.sh passed, including a probe that a new edge fails. Both design-guard tests passed. Knip counts stay at the baselines.
Impact: make test-boundaries now checks architecture edges. Frontend and ui test targets also run the knip ratchet.
Refs: feature/architecture-baseline
Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/lint-boundaries.sh

@@ -96,4 +96,5 @@ done < <(find "$root/deps/agent-native" "$root/deps/agent-squad" "$root/modules/
 if [ "$fail" -ne 0 ]; then
   exit 1
 fi
+bash "$root/scripts/lint-architecture.sh"
 echo "boundaries ok"