refactor(layering): give each colliding rule id its own number

R11 and R13 each named two unrelated rules. report() groups violations by
the rule string and titles every annotation `Layering drift (${rule})`, so a
shared number made the guard's output ambiguous about which rule fired.

Reference counts decided which rule keeps its number. R11 package-boundaries
is named in ~30 places (CONTEXT.md, ADR 0019, testing.md, the mutation and
affected-check configs, four package source comments, its own tests) against
one for the contracts rule; R13 platform-package-substrate is the RULE in
three policy files plus CONTEXT.md, ADR 0019 and model.ts against two for the
devices cutover. Both keepers stay put and the two newest rules move up:

  R11 contracts-implementation-authority -> R18
  R13 device-inventory-cutover           -> R17

R17/R18 follow the namespace's existing order-of-addition convention
(R14 #1701 < R15 #1702 < R16 #1724): device-inventory-cutover landed in
#1699, contracts-implementation-authority in #1701.

The rule-map header in check.ts is renumbered and reordered back into numeric
order, and gains the R18 entry the contracts rule never had -- without it a
reader looking up an R18 violation finds nothing where they used to find the
wrong rule. deviceInventoryCutoverSummary() was also the only OK-line summary
not leading with its rule number, which is what made the number unreadable
from the success line in the first place.

No docs needed changing: all twelve R11/R13 mentions across CONTEXT.md,
ADR 0019 and docs/agents/testing.md already refer to the keeper rules, and
both movers are described there in prose without a number.

Author: thymikee

scripts/layering/check.ts

@@ -33,10 +33,12 @@
 //     owner" shape as R7's SessionState ownership, applied to bin.ts's `--help` fast path.
 //   - Over PLATFORM PACKAGE COMPOSITION: six private metadata façades meet at the exact root
 //     composition file; premature implementation loading and forbidden cross-boundary edges fail (R13).
-//   - Over the DEVICES COMMAND CUTOVER: the handler calls the neutral inventory gateway and no
-//     superseded inventory module, import, or identifier remains in production (R13).
 //   - Over COMMAND-ATOMIC RUNTIME CUTOVERS: retired logs, network, and record routes/admission cannot
 //     coexist with their operation-fact-derived descriptor and handler paths (R14-R16).
+//   - Over the DEVICES COMMAND CUTOVER: the handler calls the neutral inventory gateway and no
+//     superseded inventory module, import, or identifier remains in production (R17).
+//   - Over CONTRACTS PRODUCTION SOURCE: contracts owns vocabulary only — host, process, and timer
+//     mechanics belong in capture-kit or an adapter (R18).
 // Only `(root)` is unranked among src/ zones (see `UNRANKED_ZONES` in model.ts):
 // it holds entrypoints and composition roots. Extracted workspace package zones
 // are classified separately and held behind R11 instead of the src folder spine.

scripts/layering/contracts-implementation-policy.ts

@@ -3,7 +3,7 @@ import type { LayeringViolation } from './model.ts';
 
 export type ContractsProductionSource = Readonly<{ path: string; source: string }>;
 
-const RULE = 'R11 contracts-implementation-authority';
+const RULE = 'R18 contracts-implementation-authority';
 const FORBIDDEN_HOST_MODULES = /^(?:node:)?(?:child_process|fs|timers)(?:\/|$)/;
 const FORBIDDEN_TIMER_CALLS = new Set([
   'clearImmediate',

scripts/layering/device-inventory-cutover-policy.ts

@@ -1,7 +1,7 @@
 import { parseSync } from 'oxc-parser';
 import type { LayeringViolation } from './model.ts';
 
-const RULE = 'R13 device-inventory-cutover';
+const RULE = 'R17 device-inventory-cutover';
 const HANDLER_FILE = 'src/daemon/handlers/session-inventory.ts';
 const INVENTORY_IMPORT_SOURCES = new Set([
   '../../core/device-inventory-context.ts',
@@ -253,5 +253,5 @@ export function checkDeviceInventoryCutover(
 }
 
 export function deviceInventoryCutoverSummary(): string {
-  return 'the devices command has one gateway-owned inventory route and no legacy route';
+  return 'R17 holds the devices command to one gateway-owned inventory route with no legacy route';
 }