Modernization 1: plan Analysis ingestion implementation

[fproulx-boostsecurity]

Summary

• define canonical per-Repository Analysis and secret-detection terminal evidence
• make schema 3.0 a clean break with no schema 2.x compatibility or ghost Assets
• define persistence-first Pantry Update and Replace operations with durable revisions
• define ordered GraphHub publication and the Kitchen-owned Analysis run outcome contract
• record the ownership, recovery, Loot, History, metadata, and Counter snapshot rules settled by Modernization 1: plan Analysis ingestion implementation #99

Stack

This pull request is stacked on #94 and targets feature/architecture-deepening. The maintainer controls review, approval, and merge order.

The implementation-ready production route is tracked by #106 and its ordered child slices #107 through #112. This pull request does not implement production behavior.

Verification

• git diff --check feature/architecture-deepening...HEAD
• checked changed documentation for forbidden em dash characters
• no tests run because the changes are documentation-only