Enforce the onboarding entry composition boundary

> [!IMPORTANT]
> Reserved for @cv. Do not self-assign this issue. Do not open an implementation PR unless @cv requests help.

Parent: #7695

Blocked by: #9169

## Problem

The onboarding entry module can regain product decisions after phase extraction.

## Scope

- Complete this work after #9169.
- Add a ratcheted architecture check for the onboarding entry boundary.
- Keep the entry module responsible for phase sequencing and dependency wiring.
- Remove temporary provider exceptions after provider extraction.

## Acceptance criteria

- The architecture check rejects provider, gateway, messaging, and policy decisions in the entry module.
- The entry module contains phase sequencing and dependency wiring only.
- The check has no temporary provider exception.
- Onboarding tests and architecture checks pass.