Setup Module Boundaries

The rule this installs:

A file outside module M may import M only through M's public entry (its barrel). M's internal files are private to M. A module's own files import each other freely.

This is the mechanical companion to the file-structure.md house rule. The semantic decision — what the modules are and where each one's front door is — is an LLM judgment in a map file; turning that map into lint rules is deterministic. Keep that seam: edit the map, never the generated config.

The map also carries a second half — where a file may live, which no import linter can see (§5).