Reported from a consumer: `layers --floor --write` printed "everything already here
passes", and the next judge found 22 breaches of the declaration it had just written.
Three defects, all mine.

1. It emitted a namespace AND a namespace nested inside it (Ai + Ai\Contracts, Ui +
   Ui\Enums, Support + Support\Enums). Declaring both splits one unit into two layers
   and cancels the containment that makes their internal references legal, so ordinary
   traffic between a namespace and its own subtree became cross-layer violations. Only
   MAXIMAL namespaces are emitted now — never one contained by another.

2. `mayUse` was left empty where real references existed, so every arrow the code
   already draws was illegal on day one. Both shapes now populate `mayUse` from the
   references actually in the source, folded up to the emitted layers.

3. `--write` anchored on the first `disable()` call in the file, which in a real config
   lives inside the `$disabledSkills` menu closure — so the layer declaration landed
   inside a disablement block. It anchors on `paths()` now: the one call that is always
   in the config's own closure.

Together these make the emission green BY CONSTRUCTION: every first-party reference
either stays inside a layer or is named in that layer's mayUse.

Proven rather than asserted — tests/Ast/Support/LayerDeclarationTest runs emit → judge
over 16 shapes (nesting three deep, siblings, prefix-not-segment `Ui` vs `UiKit`,
mutual pairs, three-hop cycles, diamonds, every reference kind, imports, vendor-only,
global scope, islands, empty) and demands silence, plus determinism, the no-nested-layer
property, and the floor being a subset that reaches nothing. 91 tests there; suite 1192.

Reproduced end to end on the reporter's own config and tree: 22 findings before, 0
after, for both --write and --floor --write.

Closes #401