policy(implementer): workaround-in-wrong-layer — fixing a downstream symptom instead of escalating to the correct owner

## Summary

Implementer, when a test fails or a story-scope surface behaves wrong at integration time, tends to patch the *nearest available* file rather than diagnose which subsystem OWNS the defect. Result: fixes land in the wrong module, dilute layer boundaries, and are frequently re-fixed in a later story when the root cause finally surfaces there.

## Repro (real cycle)

**STORY-6.06.003 F-5.3, ftc-blue.** During pr-manager's CI regression triage, `_tick_watchdog` (BC-6.06.005 stuck-state recovery) was starving under the confrontation guard — 3 tests red. Root cause: `_process()` had an `is_confrontation_active` early-return that skipped watchdog ticking entirely. The correct fix was in `curator_system.gd` (call `_tick_watchdog(delta)` inside the confrontation guard branch — 1 line).

**What almost happened:** implementer's first pass proposed adding a "confrontation-safe" flag to the watchdog's own class, in `curator_watchdog.gd`. This would have moved a confrontation-system concern into the watchdog's own responsibility surface — a layer inversion. Caught by pr-manager review before landing.

**Historical pattern (Wave 2):** at least 3 similar cases across the wave. In one, the fix went in and had to be reverted in a later story once the layer boundary was re-established.

## Root cause

Implementer's local optimum ("make the test pass") does not include a "which module owns this?" step. When story-scope narrows the search space, implementer treats any file in scope as fair game for the fix, ignoring which subsystem has the correct responsibility.

## Proposed rule

Amend implementer agent prompt:

> **Layer-boundary check before edit.** For every proposed fix that touches a file outside the immediate SUT (System Under Test) of the failing test, ask:
> 1. Which subsystem owns the behavior this fix addresses? (Read `subsystem-map.md` / ARCH-INDEX.)
> 2. Is the file I'm about to edit in that subsystem?
> 3. If no — STOP. Escalate to orchestrator with the finding and the correct owner. Do not patch across a layer boundary to make the local test pass.
>
> **Adversary check:** any implementer diff that touches multiple subsystems in one commit is IMPORTANT unless the change is explicitly a cross-cutting integration story. Vendored-diff-across-subsystems is CRITICAL.

## Detection heuristic

`git diff --name-only HEAD~1 HEAD | xargs -I{} scripts/owner-of.sh {} | sort -u` — if >1 subsystem owner, flag on story-scope PRs.

## Cross-reference

Not the same as #337 (AC-vs-BC contradiction) or #365 (rebase auto-merge). This is about implementer's *diagnosis stage*, before writing the fix.

## Provenance

Wave 2 cycle-001 lessons codification, L-W2-05 (ftc-blue). Task #16 (long-standing).