Codify REQ-CNST-003 and Tier-2/3/4 folder gates (#5035)

[Trecek]

Folder-organization gate for #5035 (tracked by #4669)

Registers REQ-CNST-003 and sets a 12-file fallback in the existing public-package count test. Adds guidance for private folders with at least 10 direct Python files, a per-file concern map for IL-0 packages with at least 20, and registration-derived Tier-3 atomicity checks with documented exceptions.

The 12-file fallback applies only where a package has no FILE_COUNT_LIMITS entry. Current explicit package limits:

cli: 9
cli/doctor: 13
cli/session: 11
config: 20
core: 10
core/audit: 5
core/claude_env: 4
core/context_admission: 9
core/git: 5
core/install: 4
core/io: 9
core/pipeline: 5
core/plugins: 10
core/runtime: 11
core/types: 76
execution: 23
execution/backends: 30
execution/github_review: 15
execution/headless: 15
execution/process: 11
execution/session: 20
fleet: 20
hooks: 27
hooks/guards: 41
pipeline: 19
recipe: 12
recipe/analysis: 6
recipe/cmd_rpc: 5
recipe/contracts: 7
recipe/helpers: 7
recipe/ingredients: 5
recipe/methodology: 6
recipe/rules: 66
server: 20
server/tools: 39
smoke_utils: 11
workspace: 1

Validation: pre-commit run --all-files passed, including the policy gate. The configured full test gate passed: 44,594 passed, 610 skipped, 34 xfailed.

Audit deviation (REQ-002, REQ-003, REQ-012)

The verified plan added a recursive public-package walk and a new 17-file limit for server/tools/tools_execution, with a second policy approval. Issue #5035 instead specifies changing the existing test's fallback from 10 to 12 and states that no package should newly fail. During implementation the requester explicitly rejected adding the 17-file exception as moving the goalpost. This PR therefore retains the existing two-level walk and adds no new package limit or approval row. Public packages below depth two remain outside this file-count test; expanding that scope requires a separately reviewed decision.

The core/fixture/paths.py regression from REQ-012 is now included because that package is reached by the existing walk and protects the root-only shim exclusion. The depth-three regression is omitted with the recursive expansion. The audit's three literal-plan MISSING findings require deviation review before merge; a green test run alone does not resolve that review.

The PR targets develop; #4669 remains open until promotion to main.