Mechanize two more Blast Radius facts, require branch-only coding work

[AdamClemens]

Summary

• Extends the six ADR-003 numerical-component entities' must_appear_in to also check docs/architecture/icds.md and their own handbook page, fixing three headings icds.md had spelled differently from everywhere else (Time Integrator/Linear Solver/Boundary Condition -> the canonical plural forms) along with every real cross-reference to them.
• Adds a new gated rule, ka-name-matches-manifest, to check_manifest.py: where a manifest row and a knowledge-architecture.md entry both cite the same KA-NNN, they must name the same file. Deliberately scoped to agreement rather than completeness in either direction, for the same reason this validator's own dropped fourth rule was dropped.
• Adds a standing rule to the root CLAUDE.md: all coding work happens on a branch, never directly on main.

Test plan

• make check-graph — clean
• make check-manifest — clean
• make check-docs — clean
• make lint / make typecheck — clean
• make test — new check_manifest.py tests pass, full suite green
• make ci — full pipeline green
• Deliberately reverted one icds.md heading locally and confirmed make check-graph fails with entity-name-appears-in-sources, then reverted back — proves the new gate has teeth, not just a clean pass by luck

🤖 Generated with Claude Code