Invert product → infra dependency for wizard-doc PII suppression (constants altitude)

Why

`src/lib/yara-hooks.ts` is L2 detector infrastructure. The wizard's design discipline says: product knowledge never enters infrastructure code.

Today, `yara-hooks.ts` imports product-specific filename constants from three programs (events-audit, audit, posthog-integration). The leaf `constants.ts` modules exist specifically to break a build-time import cycle. They solve the compile problem, but the architectural concern is unchanged: L2 still names specific programs.

When the next program ships (revenue-analytics audit, surveys audit), the convention says "add another import + another basename" — the registry of wizard product files in L2 keeps growing.

What needs to happen

Invert the dependency. Programs declare their own "doc paths" via a generic registration mechanism; L2 reads from that registry without naming any program.

Sketch:

```ts
export interface ProgramConfig {
// ...existing fields...
/** Files this program writes that are documentation, not user code. */
docPaths?: string[];
}
```

L2 reads from a runtime registry that programs populate at agent-init time.

Related

• wizard #531 tracks removing the band-aid entirely after Joe's better warlock PII rules ship. THIS issue covers the architectural cleanup of the path mechanism itself, which may persist even after #531 lands.

Anchor

`src/lib/yara-hooks.ts` — the import block at the top has a TODO marker, and the `WIZARD_DOC_BASENAMES` Set at line 307 is the registry that grows.

🤖 Generated with Claude Code

Start in src/lib/yara-hooks.ts, reading the top import block and the WIZARD_DOC_BASENAMES Set around line 307. Then trace ProgramConfig and agent initialization to understand where programs can register docPaths. Done means L2 no longer names individual programs and the generic registry is populated by programs at initialization.