Block new spelling-based C# guard scanners; point to Cluckwork.Analyzers #1184

Part of the guardrails program (/correct, class 1). Evidence: 30 merged PRs from 2026-08-04 to 2026-10-06 (about 150 findings), listed in the coordinator's D report.

Mistake. Agents write guard tests that parse C# by spelling: CSharpSyntaxTree.ParseText with no semantic model, or regex over source text. Reviewers then find one bypass per round: aliases, generics, nested types, global using, #if !DEBUG (a P1 on #1056). AGENTS.md "Writing a guard" (#407) tells agents how to write a guard, but nothing enforces it. In tests/, 10 of the 13 files that parse C# never bind symbols.

Fix (architecture, kept in place by a ratchet). C# invariants belong in src/Cluckwork.Analyzers, which already runs CW1004 as a build error. Add a test in tests/Cluckwork.Application.Tests/Architecture/: every file under tests/ that parses C# without a CSharpCompilation must be on a pinned list, one row per file with a reason. A new file fails with an error that names Cluckwork.Analyzers (see ModuleEdgeAnalyzer.cs, CW1004) or CSharpCompilation as the fix. Removing a listed file reports its row as removable.

Done when

• The ratchet is red when a fresh ParseText scanner is added, and green after revert.
• It would have flagged the scanners added in test: enumerating tenant-bypass guard + two-farm isolation matrix (#536) #584, test(arch): module ledger and cross-owner edge ratchet (#842) #872, refactor(insights): read reports, exports and audit provenance through an Insights facade #1012, test(arch): register and date every module compatibility exception #1013, refactor(accounts): move the cross-farm account reads behind IFarmDirectory #1043 and test(arch): match build symbols and reject inactive source #1056, which is shown in the PR.
• Moving the 10 existing scanners into analyzers is out of scope. Each one moves the next time someone touches it.