feat: ground naming and internals from a repo's conventional docs (itd-96)

[REPPL]

Grounds constraints/naming and internals at the conventions tier, from the files a team actually writes. Stacked on #124.

Resolves ledger issue iss-100 (.abcd/work/issues/open/) — this repository tracks issues in the record, not on GitHub, so there is no GitHub issue to auto-close.

Why

Both sections had exactly one adapter each, both native: nativeNamingSource reading the brief glossary, and the generic nativeBriefSource reading brief/05-internals/. A repository with a NAMING.md and an ARCHITECTURE.md sitting in plain sight still reported both blank, for want of an .abcd/ record. adr-36 makes that coverage debt, not a human-owned question.

What

convNamingSource reads a dedicated naming document first (NAMING.md, docs/naming*), and falls back to the glossary — cited with an explicit qualifier at lower confidence. A glossary defines terms rather than ruling on what may be renamed, so it is real evidence for naming but weaker evidence. glossary keeps its own adapter and its own row; naming is visibly a derived reading, never a duplicate. A test asserts the two rows differ in confidence and in cited string on a glossary-only fixture, and that exactly one adapter claims each section.

convInternalsSource combines architecture prose — measured with the existing README prose threshold rather than a new one — with a package-layout scan over WalkFiles.

Both ceiling at StatusPartial, matching what the mapping row already predicts for this tier, so signal strength lives in the confidence rather than in an inflated status. mapping.go is unchanged.

The security finding, and where it landed

Widening the tier gate to include the layout roots made a pre-existing hole in WalkFiles reachable: a tree carrying only src/ and no other conventional file now opens the conventions tier, and the walk had two unbounded dimensions.

• Its cap counted regular files only — a tree of directories holding nothing regular never reaches it.
• os.Root resolves every directory from the containment root one component at a time, so a chain of directories costs the square of its depth. A depth-1500 chain, trivial to create, did not finish in two minutes.

That is a denial of service on the operator's machine from an untrusted repository — exactly the population disembark targets, since abandoned wrecks often carry no README. The fix belongs with the primitive, so it landed on #124, not here: directories are counted against the same cap, descent is capped at maxWalkDepth, and both report through the existing truncated flag. Depth-1500 now walks in 0.4s; depth-400 went from 7.08s to 0.027s.

Rejected the reviewer's weaker alternative (dropping the layout roots from the tier gate) — spc-11 requires them, and removing them would falsely blank internals on a layout-only repo, which is an acceptance criterion.

Also fixed: a layout scan cut short by a cap no longer reads as a complete one. The truncation note was conditional on having found a package, so a walk that hit the cap before reaching a source root returned a blank asserting "no recognisable package layout" about a tree it never finished reading.

Verification

Detectors watched fail before each change, including the two walk-bound tests and the truncation-honesty tests. gofmt -l . empty, go build ./..., go vet ./..., go test ./..., go test -race ./internal/core/lifeboat/, abcd docs lint — all green. abcd intent ready itd-96 passes all four checks.

End-to-end against a record-less fixture repo (README, NAMING.md, ARCHITECTURE.md, an internal/ tree, work markers, no .abcd/):

constraints/naming      | partial | medium | conventions
    NAMING.md
evidence/open-questions | partial | low    | conventions
    4 work marker(s) across 2 file(s)
    internal/core/convert.go:3 (TODO)
    internal/core/convert.go:6 (FIXME)
    internal/store/store.go:3 (XXX)
    internal/store/store.go:4 (HACK)
internals               | partial | high   | conventions
    ARCHITECTURE.md
    cmd/wreck/
    internal/core/
    internal/store/
glossary                | blank
    searched GLOSSARY.md, docs/glossary* — still owned by convGlossarySource, no duplicate adapter

Every file in that tree hashed identically before and after the probe.

Captured, not fixed

iss-114 — os.Root path re-resolution is the quadratic underneath the depth cap; per-directory OpenRoot would make each open constant-time. Now bounded, so this is a performance follow-up rather than a hazard.

Two "consider" findings were left alone as spec-conformant design points: convDirHasMarkdown lists one level only, so a Diátaxis architecture tree whose Markdown lives in subdirectories is not recognised (matches the existing non-recursive convListADRs); and SourceContext has no walk cache, so the two whole-tree adapters walk independently.