🧑‍💻 chore: lint: keep sdk and the extensions away from internal

[pascalandy]

Why

M02-T2 asks just lint to keep sdk/, extensions/, and the fixture away from core's internal/ packages, so a bundled extension can leave the binary without a rewrite.

Scope

• .golangci.yml enables depguard with the rule public, which denies github.com/pascalandy/nicely/internal to every Go file under sdk/ or extensions/, tests excepted, so tests still read the docs through internal/specdoc
• The Proves line of the card no longer puts just lint in a code span, which the plan check would read as a path

Verification

A temporary sdk/runner/boundary_probe.go that imports internal/specdoc failed the lint:

sdk/runner/boundary_probe.go:3:8: import 'github.com/pascalandy/nicely/internal/specdoc' is not allowed from list 'public': the SDK and the extensions reach core only through the CLI and the environment, as AGENTS.md says (depguard)

The same import in boundary_probe_test.go passed. just check passes.

Checklist

• 1. Spec: SDK in contract.md says that just lint enforces the boundary
• 2. Scenario: the temporary import above fails the lint
• 3. Code: the lint passes without it
• 4. Text: n/a, no user-facing text
• 5. Checks: just check passes
• 6. Docs: M02-T2 is done
• 7. Sign off: just signoff runs at the merge, as the Merge section of AGENTS.md says

by Opus-5.5 via Claude Code