Publish the debt ledgers, cap three debt classes, and unbreak cargo off Linux

[niveousdragon]

Four independent changes, each answering a finding from the architecture-debt audits.

build: cargo could not run on Windows or macOS

.cargo/config.toml set build.rustc-wrapper = "scripts/rustc-wrapper.sh". That script
LD_PRELOADs tools/exdev-shim to emulate cross-directory rename() where the filesystem
returns EXDEV. Cargo has no per-platform form of that key, so every host read it, and off
Linux the shell script cannot be executed at all:

error: could not execute process `scripts/rustc-wrapper.sh` (never executed)
Caused by: %1 is not a valid Win32 application. (os error 193)

Every cargo command, on a clean clone, before any compilation. CI never saw it because its
runners are Linux. The shim is a property of one build environment, so it moves there:
export RUSTC_WRAPPER="$PWD/scripts/rustc-wrapper.sh" — absolute, because cargo resolves a
relative wrapper against the current directory rather than the workspace root. The script
and the shim are unchanged.

docs: the debt ledgers are now in the repository

They lived only in working copies, so their findings could not be read from a clone. The
external reconciliation of audit 2 had to mark nine findings "not independently verifiable
because Audit 2 omits the original finding text" — SD-011, SD-014, SD-020, SD-021, SD-028,
SD-033, SD-035, SD-037, SD-038. Their full text was in docs/architecture-debt.md all
along; the file was simply untracked.

Two corrections travel with the audit-2 ledger and are recorded inside it: its trend row
said new = 11 where the entries run SD-040 through SD-051, which is twelve; and "184
Ok(None)" is a count of lines, while one line reads Ok(None) => Ok(None), so there
are 185 occurrences.

A personal email address quoted in SD-043 was removed. The finding does not need it: what
it rests on is that five commits carry a local git identity rather than a GitHub noreply
one. Note this is a redaction of the ledger text only — the same identity remains visible
in .github/CODEOWNERS and in the authorship of those commits on main.

test: ceilings on three debt classes no lint can see

None can be driven to zero in one change, and none is visible to rustc or clippy: a
pub fn in a library crate is reachable from outside as far as the compiler knows, an
Ok(None) decline is ordinary control flow, and an environment variable is a string.

Enforced in the required python-contract job:

class	ceiling
pub fn outside crates/pyxlog with no reference anywhere in workspace Rust source	105
Ok(None) occurrences in executor/wcoj_dispatch.rs	185
distinct XLOG_* names	107

A one-way ratchet, not an amnesty: lowering a ceiling is an ordinary pull request, raising
one has to be argued for in review. ENGINEERING.md rejects deferring cleanup as technical
debt and asks for a scope decision instead of a temporary substitute — a dated, enforced
ceiling is that decision, written where CI reads it.

crates/pyxlog is excluded deliberately: a #[pymethods] pub fn is reached from Python
and never from Rust, so the same measurement would call 21 live entry points dead and
would fail this job on any ordinary binding addition.

Verified both ways: green at these numbers, and an artificial increment of each of the
three fails it (106 > 105, 186 > 185, 108 > 107).

Known limit, stated in the test's own docstring rather than glossed: the measurement is
token-level, so a name merely mentioned in a comment counts as a reference. It bounds a
class; it does not prove each member dead.

docs: ENGINEERING.md now says what it actually enforces

Two sentences claimed more than the tree delivers, which is the cheapest way for a binding
document to stop being treated as one.

"Never silently fall back" is right about degrading a result and wrong about changing
route. The WCOJ dispatcher's two kinds of decline now have different standing in the text:
a real layout or kernel failure goes through wcoj_decline_on_error, which counts, logs
and raises under XLOG_WCOJ_STRICT — observable at runtime. A structural decline returns
Ok(None) and nothing observes it at runtime at all; its only check is the source-level
cap above, which tells an operator nothing during a run. The paragraph says exactly that,
rather than claiming such declines are "counted".

"Do not merge unused public functions" is the goal, not the present state. The standard
now names the measured number, says why pyxlog is excluded, and says the number bounds a
class rather than listing items proven safe to delete.

Note for reviewers

Two tests in the required python-contract job already fail on main when run on Windows:
test_cuda_change_classifier_cli_consumes_null_delimited_git_paths (b'true\r\n' vs
b'true\n') and test_runner_self_test_has_no_benchmark_runtime_dependencies. Verified on
an untouched checkout of 404e9219; pre-existing and platform-specific, not introduced
here and not addressed here. Same class as the cargo fix above.

An independent review of this branch caught the three ceiling defects listed above before
merge; the numbers in the table are the corrected ones.