feat(boundaries): add architecture boundary checks

[bntvllnt]

Summary

• add boundaries CLI command and check_boundaries MCP tool
• add preset/custom zone analyzer with allow/forbid import rules and risky re-export-chain findings
• add no-boundary-violations check rule with new-only gate coverage
• sync README, docs, schema, llms docs, and roadmap for 2.5.0 boundary subchain

Validation

• pnpm lint
• pnpm typecheck
• pnpm test (37 files, 478 tests)
• pnpm verify:cli-real (71 pass, 0 fail)
• code-review artifact: /tmp/cbi-boundaries-review.json, CLEAN, 66/66 hunks verdicted

Dogfood

• node dist/cli.js boundaries . --list --json --force exercised repo config and returned the existing analyzer -> parser boundary violation as expected
• node dist/cli.js check . --json --force returned warn-only, 0 errors