feat(gate): resolve every cited CLAUDE.md section number, and list the four missing subpackages

[wshallwshall]

CLAUDE.md's numbered sections are a de facto API -- 653 citations across 260 tracked files -- and nothing validated a section number. link_check.py resolves the PATH and skips the fragment; the two doc guards that read CLAUDE.md check SDS identifiers and link paths. A renumber landed entirely green. This closes that.

5 files, +366/-2. CLAUDE.md is insertion-only, no section renumbered.

Verified here, not accepted on report

The authoring session's figures and mutation evidence were independently reproduced against a tree that includes main's newest CLAUDE.md change:

guard on the MERGED tree     rc=0    "sections [0..12]; scanned 1523 tracked files;
                                      653 section citations across 260 files"
renumber section 11 -> 13    rc=1    names 61 broken citations, by file and line
after revert                 rc=0    CLAUDE.md byte-identical

Their 653/260 and 61 figures reproduce exactly. The guard goes red on the defect, names the citers, and leaves no residue -- it is not green because it checks nothing.

One caution about that measurement, recorded because it nearly fooled me: my first attempt piped the guard through tail and read $?, which captured tail's exit code and reported rc=0 on a run that had plainly failed. Re-measured with no pipe. That is the trap SDS-3.8 names, and this PR's own subject -- a check that silently doesn't check -- is the same family one level up.

Why this matters beyond the file

A markdown-only PR is classified non-code and runs only the DOC_GUARDS list. This PR touches .py and .yml so it takes the full-suite path -- but if it were ever split, the CLAUDE.md-only half would run only those 15 modules. That is the blind mode this repo already records: test_link_resolution is on the list and caught a broken link on a PR earlier today, while a doc guard that was not on the list reached main. Same blind mode, two outcomes, decided purely by list membership -- and this PR adds the 15th module to that list.

Provenance

Authored by the CLAUDE.md-split session; routed here for push and PR. Verified before pushing: both commits present, genuinely unpushed, 5 files +366/-2 exactly as stated, 3 behind / 2 ahead of current main and still merge-tree rc=0. Leak scan of all 366 added lines: clean, negative control 366.

Their reported local verification, labelled as theirs: ruff + ruff format + mypy strict clean; the full 15-module DOC_GUARDS set at 219 passed / 89 skipped; all 7 pre-commit hooks green on the real commit; and the SDS nested-anchor mutation red-then-green.

Unblocks a third session: the ASVS tracking lane is recording the section-citation exposure as closed pending merge of e7e825ed rather than closed -- correctly, since a control on an unpushed branch is not a shipped control.

[wshallwshall]

Superseded by #356, which carries the identical commits (trees match at aa4933a395a8) on a neutrally-named branch.

This PR's branch name referenced an unrelated research topic and did not belong on the public repo. The change itself carries no trace of it -- verified across all 366 added lines: zero references to that topic in the code, the tests, the CLAUDE.md edit, or the commit messages. Only the branch name did, and both it and this PR are being retired rather than renamed in place, so nothing points at the old name.

No work is lost. #356 is the same tree.