chore(guardrail): report-only size check and var/ compatibility note

Add scripts/report_module_sizes.py - report-only LOC bands per layer
from the TeamHUB module-size guardrail (CONVENTIONS.md, module
contract p.6). Always exits 0: split-review stays a human decision.
Wire it into CI as a non-blocking step and into the AGENTS.md
baseline checks.

Document data/input + data/work as the deliberate compatibility
exception to the var/ rule of 18_REPO_LAYOUT_STANDARD.md in
docs/structure-map.md (compose mounts and APP_*_DIR depend on the
paths) and ignore var/ for new local runtime output.

Verified: script runs clean on the repo (159 files in scope, zero
flagged); ruff and compileall pass; adversarial review fixed two
classification bugs (frontend shell under frontend/src/app/,
app/api/security.py as infra helper).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -39,6 +39,9 @@ jobs:
       - name: Compile
         run: python -m compileall -q app scripts tests
 
+      - name: Module size report (report-only guardrail)
+        run: python scripts/report_module_sizes.py
+
       - name: Pytest (unit only — heavy deps excluded)
         # test_chunker.py skips here: it needs the pinned document recognition
         # engine (private TeamHUB_Engines repo, no PAT secret configured).