[CI] Drop stale service references from domain-is-io-free and store-emdash-is-sandbox-clean

[sumeethofficial-svg]

Closes #291

What

@otta-sh/service was deleted in INC-D3b, but two dependency-cruiser rules still named it. This removes those references.

• domain-is-io-free: dropped service from the to.path regex and the comment.
• store-emdash-is-sandbox-clean: dropped service from all three to.path clauses and reworded the comment.
• Removed both TODO(#291) markers.

Nothing is left unguarded

The family-level bans still cover both rules: store-[^/]+ and payments-[^/]+ (plus the (?!store-emdash…) lookahead) are unchanged, so a reintroduced store-postgres is still forbidden on the day it is created. A reintroduced service package is deliberately not banned by name, matching the decision already documented in plugin-is-sandbox-clean.

Tests

Added cases to depcruise-boundary.test.ts:

• domain perimeter: a resolved SQL store adapter and the plugin are forbidden (domain-is-io-free had no coverage before)
• store-emdash: a resolved payments adapter is forbidden

Verified locally: pnpm lint, pnpm typecheck, pnpm format, and the boundary suite (19/19 passing).

No changeset: no published package source changed.