refactor: consolidate safeSSABuild into shared internal/ssaguard package

[yvonnedevlinrh]

Summary

Extract the byte-identical safeSSABuild recover-guard — previously duplicated in internal/analysis/mutation.go and internal/quality/pairing.go — into a new stdlib-only leaf package internal/ssaguard with an exported SafeSSABuild. Reverses spec-021 R3 (duplication-for-dependency-lightness), which no longer applies because the guard has zero external dependencies.

Closes #238.

What changed

• New internal/ssaguard — exported SafeSSABuild(buildFn func()) (panicVal any), zero imports. GoDoc documents the ssa.BuildSerially caller precondition and the goroutine-scoped recover() rationale (spec 033); the guard is documentation-only and does not validate build mode at runtime.
• Both callers delegate — analysis.BuildSSA and quality.BuildTestSSA call ssaguard.SafeSSABuild(prog.Build), retaining ssa.BuildSerially in the mode flags and the caller-side log.Warn/log.Debug calls (preserves pkg.PkgPath diagnostic context — logging deliberately not moved into the guard).
• Duplication removed — local safeSSABuild defs, the SafeSSABuild export_test.go shims, and the duplicated TestSafeSSABuild_* test triads; deleted the now-empty internal/quality/pairing_test.go.
• Tests consolidated — 3 canonical tests in internal/ssaguard/ssaguard_test.go (100% branch coverage). Net test count -3, behavioral coverage neutral.
• Docs — updated AGENTS.md (Architecture list + Recent Changes) and docs/concepts/analysis-pipeline.md.

How to Test

go build ./cmd/gaze
go test -race -count=1 ./internal/ssaguard/
go test -race -count=1 -short ./internal/analysis/ ./internal/quality/
go test -race -count=1 -short ./...
golangci-lint run

Verify duplication is gone:

# no local definition anywhere
grep -rn "func safeSSABuild" internal/    # expect: no matches

# exactly the new shared call sites + tests
grep -rn "ssaguard.SafeSSABuild" internal/    # mutation.go, pairing.go, ssaguard_test.go

Acceptance scenarios (from openspec/changes/consolidate-ssa-guard/specs/ssaguard/spec.md):

• SafeSSABuild returns nil when buildFn does not panic.
• SafeSSABuild returns the recovered value when buildFn panics with a string.
• SafeSSABuild returns the recovered value when buildFn panics with an error.
• GoDoc documents the ssa.BuildSerially invariant (documentation-only, no runtime validation).
• Both SSA build sites use the shared guard and retain their caller-side log.Warn/log.Debug calls.

How to Demo

gaze analyze ./...
gaze quality ./...

Both run through BuildSSA / BuildTestSSA and exercise the shared guard; a panicking SSA build for any package is recovered and logged with its pkg.PkgPath rather than crashing the process.

Key Files Changed

File	Change
internal/ssaguard/ssaguard.go	New — exported SafeSSABuild, stdlib-only, BuildSerially GoDoc
internal/ssaguard/ssaguard_test.go	New — 3 canonical tests (100% branch coverage)
internal/analysis/mutation.go	BuildSSA delegates to ssaguard.SafeSSABuild; local guard removed
internal/quality/pairing.go	BuildTestSSA delegates; local guard + R3 lineage comment removed
internal/analysis/mutation_test.go	Removed dup TestSafeSSABuild_*; comment updated
internal/analysis/export_test.go	Removed SafeSSABuild shim
internal/quality/export_test.go	Removed SafeSSABuild shim
internal/quality/pairing_test.go	Deleted (held only the dup triad)
AGENTS.md	Architecture list + Recent Changes entry
docs/concepts/analysis-pipeline.md	Updated guard reference
openspec/changes/consolidate-ssa-guard/**	OpenSpec artifacts

This PR was generated by /uf.finale (AI-assisted).

[jflowers]

PR Review: #240 — refactor: consolidate safeSSABuild into shared internal/ssaguard package

Clean, well-scoped DRY consolidation. All 8 acceptance criteria from #238 satisfied. No alignment, security, or constitution compliance findings.

CI: All 5 checks green (MegaLinter, Unit+Integration Go 1.24/1.25, E2E Go 1.24/1.25).

Key verifications: GoDoc correctly documents the BuildSerially goroutine-scoping invariant (spec-033). Logging retained at call sites (preserves pkg.PkgPath diagnostic context). stdlib-only — zero external dependencies. 100% branch coverage in canonical tests.

This review was generated by /uf.review-pr (AI-assisted).