feat(lint): close the run-status write surface (coupling-core Phase A)

[proboscis]

Summary

Phase A of docs/design/coupling-core-roadmap.md: make the run-status write surface machine-checked so that delegated PRs cannot silently add status writers that bypass the step() transition policy.

before                                    after
──────                                    ─────
step() decides transitions,               step() decides transitions,
but 46 sites in 5 files also              exactly 1 sanctioned writer
write status events directly              (Daemon.updateStatus);
→ nothing stops writer #47               46 frozen sites annotated,
                                          writer #47 = CI failure

A1 — semgrep rule run-status-write-surface

• Bans model.NewStatusEvent / model.NewEvent(EventTypeStatus, …) / Type: "status" literals everywhere in internal/ (except internal/model/).
• The 46 existing writers (socket.go ×39, proto_handler.go ×4 — now fixed, monitor TUI ×2, cli/repair.go ×1) are frozen with per-line nosemgrep annotations. The whitelist may only shrink — grep -c 'nosemgrep: run-status-write-surface' is the Phase B progress meter.
• semgrep test fixtures wired into make lint; CI picks it up via quality.yaml.

A2 — fail-fast on status appends (no-ignored-status-append)

• The 4 _ = st.AppendEvent(…NewStatusEvent…) master-projection sites in proto_handler.go now propagate append failures with run context.
• failOpenCodeRunBootstrap (socket.go): error-recording path keeps returning the original bootstrap error, but append failures are now logged instead of swallowed.
• New rule bans the discard pattern from reappearing.

A3 — routing rules in AGENTS.md

Coupling-core inventory, frontier/delegate routing rule, tripwire checklist for delegate PR review, choice-space gate, and the burn-in loop.

Verification

• make lint: 0 findings (105 rules), new fixture tests 2/2 pass
• Synthetic 47th writer trips both new rules (negative test, reverted)
• go build ./... clean; go test ./internal/daemon ./internal/cli pass
• internal/monitor TestSessionNameForProject fails identically on main (environment-dependent session-name truncation) — pre-existing, untouched by this PR

🤖 Generated with Claude Code