Empty the dependency-rule allow-list (#378 follow-up)

Follow-up of #378. The decision is made and enforced: ADR-0001 § "Dependency rule and effects" (#561, #562, #563) names the rings, scripts/CheckDependencyRule.fsx runs on every CI build, and the stub projects are gone (#417). What is left is the migration itself, planned in docs/implementation-plans/378-dependency-rule.md.

Goal

Empty the allow-list in scripts/CheckDependencyRule.fsx, so the ADR-0001 section can move from Proposed to Accepted. The list is a ratchet: an entry that no longer matches fails the run, so every PR that removes a violation also removes its allowance.

Where it stands (2026-09-11)

78 allowances, of which 5 are marked Permanent (string-only System.IO.Path helpers, Environment.ProcessorCount chunk sizing, a memoized pure equation list, a stopwatch in an example). The remaining 73 group by the reason string in the script:

Phase 0 is done except those two deletions; the DoseRuleLoader.fs warm-up (Phase 0 step 2) is also still in place.

Steps

One child issue or PR per phase, as the plan suggests, each shrinking the list:

• Phase 0 rest: delete getDataFromGenPres, agentLogger, and the warm-up in DoseRuleLoader.fs. Removes 2 allowances.
• Phase 1 logging: split Logging.fs (port stays, agent runtime to Agents.Lib); factories to the composition roots; route every console write through the injected Logger, one project per PR. Removes 44 (the largest block; touches the discussion in #416).
• Phase 2 eviction: adapter project for the sheet/NKF loaders, the resource registry composition and the cached provider; Utils pure/IO split; getDataFromSheet returns Error instead of [||]. Removes 24.
• Phase 3 inversion GenFORM → ZForm → ZIndex: GenFORM-owned contract types, mapping in the adapter, drop the ZForm reference. No allowances today, but the project-reference check.
• Phase 4 non-determinism: now and newId parameters. Removes 4.
• Phase 5 DMZ: one authentication path, GENPRES_* reads only in the composition roots, MCP host composes the same AppEnv. Security-relevant.
• Phase 6 client and Shared: the client's own sheets through the server (#582 plan), the shared-calculation agreement test, the two C items as their own issues with MDR validation.
• Flip the ADR-0001 section status to Accepted and delete the plan file.

Out of scope

Project merging as first proposed in #378 (Foundation, Integration, tests into libs): rejected in ADR-0001, alternatives considered.