feat(scaffold-core): governance/ module — threat-model, adr, test-plan generators

[stackbilt-admin]

Part of #212.

Scope

Extract governance document generation from buildGovernance() in stackbilt-web/src/lib/scaffold-core.ts into packages/scaffold-core/src/governance/.

Files to create

File	Responsibility
threat-model.ts	buildThreatModel(classification, knowledge, profile, routes, bindings) → string
adr.ts	buildAdr(classification, knowledge, intention, projectType) → { adr001: string; adr002?: string }
test-plan.ts	buildTestPlan(classification, profile, routes) → string
index.ts	Re-exports buildGovernance(...) → GovernanceDocs

Dependencies

• classify/ (ClassifyResult, QualityProfile)
• knowledge/ (PatternKnowledge)

Tests

• Threat register always has ≥8 items
• ADR-002 only present for ai-chat pattern
• Domain threats (PHI/PCI/PII/telephony) injected when intention contains relevant keywords
• All output is valid markdown (headings, no broken syntax)

[stackbilt-admin]

Work shipped in @stackbilt/scaffold-core@1.1.0 (charter#212, PRs #219-222). Closing stale tracking issue.