debt: 27 functions have cyclomatic complexity over 30 and the five longest run 423 to 1,120 lines (`newRootCommand`, `runServer`, `taskFuncHTTP`, `runCase`, `runWorkflow`); no ceiling or ratchet exists, so the number only rises

Observed behavior

At eb8172f, measured with gocyclo over non-test, non-generated Go under pkg, cmd, plugins, tools: 96 functions over 20 and 27 over 30. The top of the table:

And by length (lines from func to the next top-level declaration):

The conformance case constructors (WaitCases, InputOutputCases, UndoCases) are long by nature and are not the concern. The concern is that the three most consequential functions in the product are among the largest and least reached: taskFuncHTTP is the http task in one 477-line closure with 56 branches, in a file whose test reach is 7 of 17 functions (#1718); runWorkflow is the workflow-side interpreter, replayed deterministically and therefore the code where a refactor is most expensive to get wrong later; (*compiler).step is where every Flowfile key is admitted and #1542 wants it derived. newRootCommand and runServer are the cmd/flow extraction #1652 already owns.

Nothing bounds this. tools/vacuity and staticcheck carry no complexity rule; gocyclo is not in the toolchain; AGENTS.md asks for "the smallest coherent diff", which is right per change and is exactly how a function reaches 1,120 lines.

Desired outcome

• A ratchet, not a rule: tools/complexity (or gocyclo through the tool directive, #1729) with a per-function allowlist of the current 27 over 30; a new function over 30 or a listed function that rises fails the gate, and a listed function that drops is removed from the list by the same PR. Same for length at 300 lines.
• The three product-critical functions each get a decomposition issue with a shape, in this order: taskFuncHTTP into request build, policy decision, transport, response shaping, and expect: evaluation (each testable alone, which is what #1718's reach needs); runWorkflow into the per-node dispatch it already has in execute.go plus a small loop (with the replay corpus as the safety net); (*compiler).step behind the key table #1542 derives.
• docs/ARCHITECTURE.md records the ceiling and the reason in one paragraph.

Acceptance criteria

• The gate fails on a scratch function with complexity 31 and passes on the current tree.
• taskFuncHTTP's file has direct tests for each extracted part and reach above 80 percent.
• The allowlist shrinks in every release, tracked in the job summary.

Constraints and dependencies

• Adjacent: #1652 (cmd/flow extraction), #1718 (test reach), #1542 (derived key table), #1672 (parameter-list idioms), #1729 (tool directive), the replay corpus for runWorkflow.

Start by reading tools/vacuity and the current staticcheck setup, then inspect the listed Go functions and the adjacent issues #1652, #1718, #1542, and #1729. The work is done when the complexity and length ratchet passes the current tree, rejects the stated scratch case, and the documented decomposition, tests, allowlist shrinkage, and docs/ARCHITECTURE.md update are complete.