AUR-558 -- cmd/aurumcode organised by responsibility, with a structural guard

A refactor with no change of behavior, continuing AUR-557.

What moved

Decision logic into `internal/gate`

Before (`cmd/aurumcode`)	After (`internal/gate`)
`evaluateGate`, `severityRankOf`, `effectiveSeverityRank`, origin constants (`policygate.go`)	`policy.go`: `EvaluateGate`, `SeverityRankOf`, `EffectiveSeverityRank`, `OriginPolicy`, `OriginRepo`
`matchException` and its lines/markers (`aur520.go`)	`exceptions.go`: `MatchException`, `TruncateToUTCDate`, `AcceptedExceptionLine`, `ExpiredExceptionLine`, `ExceptionsConfigured`, `RepoIdentityUnavailableNotice`
`applyAnalysisGate`, `analysisIssuesForGate`, `gateSASTIssues`, `foldGateSources` (`gate_sources.go`)	`sources.go`
`applySASTGate` (`aur548.go`)	`sast.go`: `ApplySASTGate`
`applyAnalysisDataGate` (`aur533.go`)	`analysisdata.go`
`applyDTrackGate`, `mergeDTrackGate`, `wrapWriterWithFilter` (`aur550.go`)	`dtrack.go`
`reuseOrStoreGateVerdict`, the verdict key and store (`aur524.go`)	`verdict.go`
`applyGateOutcome` (`main.go`)	`outcome.go`: `ApplyOutcome`
the seven contributor adapters (`review_gate_contributors.go`)	`contributors.go`: exported types with fields

What the gate needs from the command is injected, not imported: the prompt digest (VerdictReuseContributor.PromptDigest), and the review-context cache key (VerdictKeyInputs.ContextKey, a lazy func() string so a nil provider is only touched when a verdict can be reused, as before). The binary identity (binaryIdentity, which reads the command's version) stays in verdict_inputs.go and arrives in VerdictKeyInputs.BinaryIdentity.

review_gate.go is the only production file of cmd/aurumcode that imports internal/gate. It declares the pipeline (assembleGatePipeline) and the command's names for the package (gateDecision, gateRun, gateOriginRepo, and so on); every other file uses those names.

generateReview left pr.go for review_pr_generate.go; applyGateOutcome left main.go for gate.ApplyOutcome.

Files named by responsibility

aur515.go checkout_identity.go; aur520.go internal/gate/exceptions.go (and repo_identity.go for localRepoIdentity); aur521.go compliance_artifacts.go; aur524.go internal/gate/verdict.go; aur533.go internal/gate/analysisdata.go; aur536.go verified_checkout.go; aur537.go provider_failure.go; aur538.go status_description.go; aur548.go sast_pass.go; aur549.go cmd_sbom.go; aur550.go internal/gate/dtrack.go; aur551.go cmd_sign.go; aur552.go cmd_xbom.go. All with git mv. main.go, pr.go, passes.go, review_cache.go and policygate.go keep their names: acceptance scripts outside this card still read them.

Structural coverage stays in the analyses phase

applyStructuralCoverage (structural_coverage.go) runs before the inconclusive reason is ranked, and its notice must keep its place in Limitations ahead of the changelog and policy notices. A pipeline contributor runs after the analyses and the reason ranking, so moving it there would reorder the published Limitations. It is therefore not a contributor.

Tests

The tests that call the moved functions stay in package main and now call the internal/gate API (igate.EvaluateGate, igate.MatchException, ...): the assertions are unchanged, only the callee's package. They did not move into internal/gate because the acceptance scripts select them by name in ./cmd/aurumcode, and moving them would change every selector. Files: aur520_test.go, aur521_test.go, aur524_test.go, aur533_test.go, aur538_test.go, aur548_test.go, aur550_test.go, policygate_test.go. passes_test.go reads verified_checkout.go instead of aur536.go.

Guards (go/ast, in `structure_test.go`)

TestAUR558NoProductionFileNamedByCard: no production aur[0-9]+.go in cmd/aurumcode.
TestAUR557NoFunctionExceedsLineLimit: no function above 150 lines (unchanged).
TestAUR558GateImportedOnlyByAssembly: internal/gate is imported only by review_gate.go, and that file must still import it (the guard cannot pass vacuously).
TestAUR558ArchitectureDocCitesEveryInternalPackage (architecture_doc_test.go): every package of internal/ is cited in docs/architecture.md.

Acceptance scripts realigned (card v3)

Only the file reference changes: existence lists, -f checks, the mutation target. The mutation and the expected red are the same, and no assertion was removed.

Script	Change
`AUR-520.sh`	target `internal/gate/exceptions.go`; anchor `if TruncateToUTCDate(now).After(expires) {` (the function is exported)
`AUR-521.sh`, `AUR-537.sh`, `AUR-548.sh`	`aur521.go` is now `compliance_artifacts.go`
`AUR-524.sh`	`aur524.go` is now `internal/gate/verdict.go`
`AUR-533.sh`	target `internal/gate/contributors.go`; anchor `ApplyAnalysisDataGate(...)`, replaced by `Result{}`
`AUR-537.sh`	`aur537.go` is `provider_failure.go`; the two mutations target `review_pr_generate.go`
`AUR-538.sh`	`aur538.go` is `status_description.go`; the mutation removes the withheld marker in `internal/gate/outcome.go`
`AUR-548.sh`	`aur548.go` is `sast_pass.go`
`AUR-549.sh`, `AUR-551.sh`	`aur549.go` is `cmd_sbom.go`; `aur551.go` is `cmd_sign.go` (mutation target)
`AUR-550.sh`	`aur550.go` is `internal/gate/dtrack.go`
`AUR-552.sh`	`aur552.go` is `cmd_xbom.go`
`AUR-556.sh`	`gate_sources.go` is `internal/gate/sources.go` (list and mutation target)
`AUR-449.sh`	MUT-001 target `review_base_analysis.go`; anchor `if b.providerErr != nil && f.modelo == "" && errors.Is(b.providerErr, errNoProviderConfigured) {` (AUR-557 moved the guard out of `main.go`); `AUR-547.sh all` runs it
`AUR-519.sh`, `AUR-522.sh`, `AUR-543.sh`	no change needed: the files they anchor on did not move

Known follow-ups

AUR-557.sh AC-002-MUT-001 (not editable here) rewrites review_pr_gate.go with gate.NewPipeline(...); that file no longer imports internal/gate, so that one mutation selector fails to build. all and AC-001-full of AUR-557 do not depend on it except through all.

Acceptance (`tests/acceptance/AUR-558.sh`)

See the header of the script. all runs AC-001, AC-003, AC-004, both structural mutations, AC-002-MUT-002 and the seven reanchored mutation selectors; AC-002-full is AUR-557.sh AC-001-full.

Acceptances realigned for AUR-557's changes (card v5, v6)

Script Change

AUR-448.sh AC-001-MUT-001 targets review_base_quality.go (reportQualityOutcome); guard if warning := b.result.Metadata[key]; warning != "" {, anchor fmt.Fprintf(b.stderr, "aurumcode review: %s\n", warning); the print is replaced by a no-op only for discard_warning (the other two keys still print), so the outcome is the one AUR-547.sh pins for this selector (exit 1, MUT-001/not-rejected); AUR-547.sh all is green

AUR-557.sh AC-002-MUT-001 rewrites the --pr call with newGatePipeline(...) (the alias review_gate.go declares) instead of gate.NewPipeline(...); same effect, one contributor dropped from --pr only

mkdocs.yml carries - Arquitetura: architecture.md in its explicit nav; bash scripts/docs/build.sh (strict) builds with no warning.