The command and the configuration it writes shipped in v4.189.0 with only the CLI
`--help` text to explain them, so the one rule that needs configuring was the one rule
the README never mentioned.

Usage gains the three forms, and Configuration gains "Declaring your layers": the
top-down declaration, what counts as a reference, and the three rules that decide a
breach — both ends must be declared, a layer contains its own sub-namespaces, the most
specific declared layer wins on segment boundaries.

It states the consequence that surprised me while building it, rather than leaving a
reader to find it: an undeclared namespace is always allowed, so a declaration bites in
proportion to how much of the tree it covers. That is why `layers` proposes today's
whole shape, and why cycles have to be broken first.