Fix security and architecture issues on codebase-discovery skill

[bsigney]

Fix state continuity and coverage reporting in codebase-discovery

Phase 0 and resume

• Phase 0 settles the output root before writing anything. It previously created docs/_discovery/ in step 1 and agreed the destination in step 4.
• Prior state is located by searching the tree including git-ignored paths, since the disposition recommends ignoring the file the search looks for.
• A missing state file no longer means first run. The committed register and traceability index are checked too, and initialisation creates only what is absent.
• --fresh runs git ls-files before telling the user what is recoverable, and names the case where git is unavailable.
• Tier 0 records the map and area list before pausing for approval, so an unanswered gate resumes instead of restarting.
• Resume table gained rows for code-only and for state that did not survive a clone, and now names phases for the drift case.
• A re-run that re-recons drifted code returns through Phase 2 when the register holds open interview items.

Coverage

• Coverage states are a closed set of four in provenance-and-status.md, with a producer for each and consumers in Phase 3, the entry point, Phase 4 and the completion report.
• The entry point declares coverage on a line of its own, so single-area systems report it without an Areas table.
• current-architecture.md carries the component-to-area mapping and flags components recon never read with [unchecked].

Write safety

• The write contract names both files written outside the output root, README.md and the agent file, and rule 6 blocks re-initialising the two committed audit files.
• Phase 4's no-go verdict reaches Phase 5, which withholds the agent file unless the user signs off knowing what failed, and records the verdict in the committed register.
• Nav registration on a published docs site is stated as a manual step rather than offered.
• current-architecture.md and discovery-state.md carry the secrets-rule pointer that integrations.md already had.

Consistency

• Glossary stays one file, with an Area column for area-specific terms.
• The bundled verifier gained the two Phase 4 checks it was missing and dropped one it lacked the tools to run.
• Phase 3 sources the glossary from code language in code-only mode, where nothing is stakeholder-confirmed.
• Question bank covers all seven items on Phase 2's checklist, including how rules and flows group.
• Traceability index documents both ID schemes, C-n and FR-n / NFR-n.
• README's Modes section matches the status model instead of describing per-line stamping.

node scripts/validate.js passes.