Add dashboard contracts export surface and restrict deep domain imports

[danielbdyer]

Motivation

• Provide a single, stable import surface for dashboard-consumed domain symbols to avoid brittle deep imports and enable a gradual, additive migration.
• Prevent the dashboard from depending on internal-only domain modules by enforcing a clear boundary that can be tightened over time.

Description

• Added lib/domain/observation/contracts/index.ts which re-exports the dashboard domain surface and the dashboard-facing projection/handshake symbols, and selectively re-exports Governance/ResolutionMode from lib/domain/governance/workflow-types.
• Replaced direct deep imports in the dashboard (server + dashboard/src/**) so they import domain types/functions from lib/domain/observation/contracts instead of lib/domain/observation/dashboard, lib/domain/projection/*, lib/domain/handshake/workbench, or lib/domain/governance/workflow-types.
• Updated eslint.config.cjs to stop ignoring the dashboard and added a no-restricted-imports rule scoped to dashboard/src/** that blocks the former deep import paths and instructs callers to use the new contracts root.
• Kept the contracts layer additive-first and selective to avoid symbol collisions and to allow a progressive migration without breaking consumers.

Testing

• Verified deep imports were removed with rg -n "lib/domain/(observation/dashboard|projection/|handshake/workbench|governance/workflow-types)" dashboard/src dashboard/server.ts which returned no matches.
• Ran npm run lint, which reported existing repository-wide lint errors unrelated to this change (lint run failed in the workspace but the change introduced the new ESLint rule and adjusted imports as intended).
• Ran npm run typecheck and npx tsc -p dashboard/tsconfig.json, which failed due to missing generated artifacts and pre-existing typecheck diagnostics in this environment and baseline repo state, not due to the contractual import changes.

---

Codex Task