arch: add automated lint rules for package and feature boundaries

[cursor]

Problem

Architecture boundaries are documented in `.agents/rules/` but not mechanically enforced. Recent violations slipped in despite clear written rules:

• Files feature importing shell `content-panel` internals (arch: split ownership of content-panel definitions #270)
• Files feature reading route identity via `useMatch` (arch: files feature reads route identity via useMatch #275)
• Duplicate harness ID whitelist (arch: duplicate HarnessAgentId whitelist in server types #267, arch: session-repository hardcodes harness IDs instead of contract schema #268)

Suggested fix

Add oxlint custom rules (similar to `tools/oxlint/node-import-style.mjs`) for:

1. `apps/app/src/features/*` must not call `useMatch` (route identity belongs in composition roots)
2. `apps/app/src/features/` must not import from `@/features/`
3. `apps/app` must not import `@vibest/server`
4. `packages/contract` must not import other `@vibest/*` packages

Defer until panel ownership is settled (#270):

• Blocking `@/components/layout/content-panel/*` imports from features

Severity

P2