feat(R01): architecture foundation, offline fakes and characterization net

EPIC R01 (Team Duy) - safety net before the parallel refactor starts.

R01-T01 docs/architecture/ADR-001-layered-architecture.md
  4-tier boundaries, allowed dependency directions, invariants I1-I6 and
  the strangler-fig migration strategy.
R01-T02 tests/fakes/{fake_provider,fake_tool_executor}.py
  Scripted, offline Provider and extra-tool executor doubles.
R01-T03 scripts/check_imports.py
  AST-based Clean Architecture Guard (CASAN Check 3). Also covers relative
  imports and function-local imports; ASCII-only output for cp932 consoles.
R01-T04 tests/characterization/test_run_cowork.py
  13 snapshot tests pinning run_cowork's current observable contract before
  EPIC R04 moves its orchestration into application/.
R01-T05 docs/architecture/dormant-code.md
  Import-graph scan: 43 unimported modules verified down to 6 genuinely
  dormant items (~1887 LOC); the rest run via subprocess/CLI entry points.

tests/conftest.py binds `cowork_local` to THIS checkout by absolute path -
previously sys.path discovery could import a sibling checkout and the suite
would silently test the wrong code.

Suite: 104 passed, 1.08s (2 pre-existing failures in test_config_security.py
remain - config.py still ships a hardcoded default password, EPIC R02/Team Nam).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -0,0 +1,63 @@
+"""Root pytest configuration: bind ``cowork_local`` to THIS checkout (R01-T02).
+
+Why this file exists
+--------------------
+The package directory is itself the distribution package (``__init__.py`` sits
+at the repo root), so ``import cowork_local`` only resolves when the checkout
+folder happens to be named exactly ``cowork_local``. It frequently is not — this
+one is checked out as ``cowork_local_gitea``, and developers keep several dated
+copies side by side (``cowork_local``, ``cowork_local_20260722``, ...).
+
+Left alone, ``sys.path``-based discovery would import whichever *sibling* folder
+is named ``cowork_local`` and the whole suite would silently test a DIFFERENT
+checkout: green here, broken in the branch under review. That is the worst kind
+of test failure, because it fails to fail.
+
+So instead of relying on the folder name, we load ``__init__.py`` by absolute
+path and register the result in ``sys.modules`` under the canonical name before
+any test imports it. Submodules (``cowork_local.providers.base``, ...) then
+resolve through this package's own ``__path__``, i.e. always this checkout.
+"""
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+
+# .../<checkout>/tests/conftest.py -> .../<checkout>
+_PKG_DIR = Path(__file__).resolve().parents[1]
+_PKG_NAME = "cowork_local"
+
+
+def _bind_package_to_this_checkout() -> None:
+    """Make ``import cowork_local`` mean this directory, whatever it is named.
+
+    A no-op when the correct package object is already bound, so running the
+    suite from a folder that IS named ``cowork_local`` costs nothing and the
+    hook stays idempotent across repeated conftest collection.
+    """
+    existing = sys.modules.get(_PKG_NAME)
+    existing_file = getattr(existing, "__file__", None)
+    if existing_file and Path(existing_file).resolve().parent == _PKG_DIR:
+        return  # already the right one
+
+    spec = importlib.util.spec_from_file_location(
+        _PKG_NAME,
+        _PKG_DIR / "__init__.py",
+        # Setting the search locations is what makes dotted submodule imports
+        # (cowork_local.core.*, cowork_local.providers.*) resolve inside THIS
+        # directory rather than through sys.path.
+        submodule_search_locations=[str(_PKG_DIR)],
+    )
+    if spec is None or spec.loader is None:  # pragma: no cover - packaging error
+        raise RuntimeError(f"cannot load {_PKG_NAME} from {_PKG_DIR}")
+
+    module = importlib.util.module_from_spec(spec)
+    # Registered BEFORE exec_module so that a self-referential import inside
+    # __init__.py would find the partially-initialised module instead of
+    # recursing - the same protocol CPython's own import machinery follows.
+    sys.modules[_PKG_NAME] = module
+    spec.loader.exec_module(module)
+
+
+_bind_package_to_this_checkout()