chore(guardrail): report-only size check and var/ compatibility note

Add scripts/report_module_sizes.py - report-only LOC bands per layer
from the TeamHUB module-size guardrail (CONVENTIONS.md, module
contract p.6). Always exits 0: split-review stays a human decision.
Wire it into CI as a non-blocking step and into the AGENTS.md
baseline checks.

Document data/input + data/work as the deliberate compatibility
exception to the var/ rule of 18_REPO_LAYOUT_STANDARD.md in
docs/structure-map.md (compose mounts and APP_*_DIR depend on the
paths) and ignore var/ for new local runtime output.

Verified: script runs clean on the repo (159 files in scope, zero
flagged); ruff and compileall pass; adversarial review fixed two
classification bugs (frontend shell under frontend/src/app/,
app/api/security.py as infra helper).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/structure-map.md

@@ -51,6 +51,19 @@ legacy-knowledge-indexer/
   or rename only for symmetry.
 - Shared OCR/document-recognition logic should move through `Engines`, leaving
   thin app adapters.
+- `data/input/` and `data/work/` are the accepted ignored runtime-state dirs
+  (deliberate exception to the `var/` rule of `18_REPO_LAYOUT_STANDARD.md`):
+  docker-compose mounts `./data/input:/data/input` and `./data/work:/data/work`,
+  and `APP_INPUT_DIR`/`APP_WORK_DIR` point there. Moving them under `var/`
+  needs a scoped migration touching compose, config defaults and RUNBOOK.
+  New kinds of local runtime output (logs, exports, reports) go to the
+  ignored `var/` directory.
+
+## Module-size guardrail
+
+`python scripts/report_module_sizes.py` prints the report-only LOC bands per
+layer (CONVENTIONS.md module-size guardrail). It runs in CI as a non-blocking
+step; split-review stays a human decision.
 
 ## Next safe steps