[GRV-26]: Establish attribution catalog and repair boundary guard

[riddim-developer-bot]

Summary

Part of the llm-cost architecture contracts Project. Two deliverables, both scoped to the llm-cost-attribution package (per this issue's title + llm-cost-attribution label):

1. Repair the boundary guard so its config reflects the package after the estimation extraction.
2. Establish the attribution use-case catalog as the canonical, complete source of truth for the attribution surface.

Repair boundary guard — packages/llm-cost-attribution/scripts/check-boundary.mjs

The boundary config carried two dead references to modules that were extracted to llm-cost-estimation (in GRV-2 / the estimation split) but never removed here:

• src/enrich.mjs in coreModules
• src/linear-estimate-source.mjs in adapterModules

Neither file exists in this package, so existsSync silently skipped them — the guard claimed to protect/classify modules it can no longer see. Repaired by:

• Removing both dead entries.
• Replacing stale remediation text that still pointed at the moved LinearEstimateSource with port-neutral attribution guidance (SessionSource / IssueMatcher / UsageRecordSource / UsageRecordSink). The defensive @linear / https / fs / child_process forbidden-package rules are kept.

To repair the class of bug (not just the instance), test/boundary.test.mjs now:

• Adds config-integrity tests asserting every configured coreModules / adapterModules path exists on disk, so dead or phantom entries fail CI instead of silently passing.
• Exercises the core-imports-adapter rule against a real adapter (attribution-adapters.mjs) instead of the removed Linear adapter.

Establish attribution catalog — docs/architecture/use-case-catalog.md

• Added a canonical intro, the inward dependency rule, and the linkage to the boundary guard that enforces it.
• Cataloged the two remaining public use cases that were documented in the package catalog/README but missing here: CreateAttributionWorkflow and ListKnownIssues. The catalog now covers the full attribution public surface.

Verification

• npm test (llm-cost-attribution): 200 pass / 0 fail (was 198; +2 new config-integrity tests).
• node scripts/check-boundary.mjs: Boundary check passed.
• node --check on changed scripts/check-boundary.mjs and test/boundary.test.mjs: ✓.
• Project-acceptance, llm-cost-architecture-contracts — GRV-26's portion is fully green:
  • architecture-boundary.check.mjs (runs the repaired guard): ✓
  • attribution-ports.test.mjs: ✓
  • catalog/API alignment: no findings for llm-cost-attribution.
• Rebased onto latest origin/main (includes [GRV-27]: Resolve estimation API and catalog drift #43 / GRV-27).

Out of scope (observed, not fixed here)

The non-required project-acceptance gate still reports one finding, in the separate llm-cost-estimation package, left by the just-merged GRV-27 (#43): packages/llm-cost-estimation/docs/use-cases.md:67 marks the now-implemented forecastProjectCost as planned/stubbed. That is estimation-catalog territory (GRV-27's rollout), not this attribution issue — flagged here as a breadcrumb for a follow-up rather than mixing packages in one PR. pr-build (the required gate) excludes the project-acceptance directory, so this does not block merge.