[MIND-36] Architecture compliance: declare and enforce module persistence class in CI

[ucguy4u]

Problem

Invariants I1, I2, and I4 (design spec §11a) found four architectural violations within a day of being written: DriftMeetingRepository, features/coins/, features/money/, and the settings AI-storage dashboard.

That is the argument for automation. Invariants only a reviewer can check are invariants that erode — and the last two defects in the Vault plan both survived review because nothing carried forward between passes.

Expected outcome

Every module declares how it persists, and CI validates the declaration against what the code actually does.

module:
  persistence: runtime | projection | ephemeral

Value	Meaning	Allowed to write
runtime	Durable user state, via operations	Nothing directly — the runtime writes
projection	Derived, rebuildable, disposable	Its own index or cache, droppable without data loss
ephemeral	Process- or session-scoped	Temp files, in-memory caches, nothing outliving a reinstall

Checks

• Every module.yaml declares persistence. Missing is a failure, not a default.
• A module declaring runtime that opens a database, writes a JSON file, or touches preferences fails.
• A module declaring ephemeral that writes outside a temp path fails.
• A module declaring projection must have a rebuild-from-scratch test — that one cannot be caught by grep, so the check is "the test exists and is named by convention".
• Extends scripts/check-module-manifests.py, which today only globs packages/*/module.yaml — it must also cover app/lib/features/ and rust/ (the latter is [MIND-32] Give rust/airo_mind an enforceable owner and ship policy #1258).

Expected initial state

This will fail on day one, on the four modules above. That is the point. Land the checker with those four on an explicit, dated exception list that shrinks — never grows — with each migration under #1293.

An exception list that can grow is just a checkbox. The list must be append-only-by-PR-review, and adding to it should require the same officer sign-off as any invariant change.

Related

#1287 covers crypto-path hygiene checks in rust/airo_mind. This issue is the repo-wide architectural layer. Both are the same idea: move enforcement out of reviewer memory.