tsa-constraints

Architectural constraint enforcement. Detect forbidden cross-module calls ("MCP must not depend on CLI") at index time and gate edits on them. Rules live in YAML at repo root; violations bubble up through edit action=safe and edit action=impact as UNSAFE verdicts. Use when: — User asks "does this PR break architecture?" — Pre-merge gate: "any forbidden edges?" — User wants to ADD a new architectural rule — You see a…