feat: add module schema discovery and validation

docs/architecture/repository-boundaries.md

@@ -32,7 +32,8 @@ These rules map platform ownership to filesystem and package boundaries. The exe
 - Workspace package names are unique and shared packages declare a recognized architectural role.
 - Circular source and workspace-package dependencies are rejected.
 - Cross-module data access uses services, events, capabilities, or opaque identifiers rather than
-  direct table imports and foreign keys.
+  direct table imports and foreign keys. Modules may not import another module's Drizzle tables,
+  columns, relations, schema entrypoint, or migration internals.
 
 The boundary test suite includes intentionally invalid fixture graphs. This proves that the guard
 rejects every currently machine-checkable repository rule even before production packages fill
@@ -40,8 +41,8 @@ every directory. The UI guard rejects component, view, template, stylesheet, sha
 common UI-framework dependencies inside modules. This deny list is defense in depth; package
 review remains required when adopting a new frontend technology.
 
-Cross-module table ownership, foreign keys, and schema namespace rules require Drizzle metadata
-and are intentionally deferred to the Phase 3 schema validator.
+The Phase 3 schema validator complements source boundaries by checking table ownership, foreign-key
+targets, and physical table namespaces in compiled Drizzle metadata.
 
 ## Generated code