Modernization 1: define Analysis ingestion architecture

[fproulx-boostsecurity]

Program context

This PR is the second PR in the stack that starts the SmokedMeat modernization program. It is the ADR-only decision slice for the first architecture deepening iteration and is tracked by the program's native child issue 98.

Initial PR stack

1. Foundation: Establish agent engineering foundations for iterative modernization, tracked by issue 97.
2. This PR - first architecture decision slice: define the Analysis ingestion ownership and persistence contracts before implementation.

This PR is stacked on PR 93 with base branch feature/agentic-engineering-modernization. Review and merge PR 93 first.

Implementation is intentionally outside this PR. Later Wayfinder and implementation work must treat these ADRs as settled constraints and remain separately reviewable under the program guardrails.

Review focus

Please focus review on whether ADR-0002 and ADR-0003 establish the right durable constraints:

• Kitchen owns canonical Analysis ingestion into Pantry
• reconciliation is scoped to explicitly successful repositories
• runtime and other engagement evidence is preserved
• secret-detection provenance is engine-neutral
• Pantry reconciliation is persisted before live publication
• concurrency, failure, retry, performance, and verification obligations are explicit

What changed

• define Secret detection and Analysis ingestion in the domain glossary
• record Kitchen as the canonical owner of Analysis ingestion into Pantry
• define repository-scoped reconciliation and engine-neutral secret-detection provenance
• define durable-first Pantry publication using the current BBolt snapshot
• document Counter, GraphHub, concurrency, failure, and explicit retry behavior
• capture large-organization performance risks and required instrumentation

Why

Analysis results are currently imported through overlapping Kitchen, Counter, and legacy Pantry paths. Settling one ownership seam and one persistence contract before implementation keeps this iteration bounded and gives later implementation a clear deletion target instead of adding another parallel path.

Impact

This is documentation only. Runtime behavior, Counter UX, and schema versions are unchanged.

Validation

• ran git diff --check
• checked the changed documentation for em dashes

No tests were run because this draft changes documentation only.

Closes #98