refactor(architecture): follow-ups from the 2026-09 architecture audit

[Karib0u]

Summary

Follow-ups from the 2026-09-29 architecture and maintainability audit, at 8c6ac3f.
#361 shared runtime construction, split the ETW module, and centralized path allowlists; this tracker covers what remains.
Each item is behavior-preserving unless it says otherwise, and each lands as small, independently reviewable PRs.

Tracked

• refactor(runtime): run live detection and capture through one sensor-set runner #658
• refactor(architecture): enforce a one-way module dependency direction #659
• refactor(artifact): split artifact.rs into resolver, store, and pipeline-stage modules #660
• refactor(models): derive event actions from one table #661
• refactor(telemetry): replace process-wide counters and registries with pipeline-owned handles #662
• refactor(linux-ebpf): declare the kernel event ABI once #663
• chore(sensor): finish the RawEvent rename and remove the compatibility aliases #664
• chore(lint): document every unsafe block and enable undocumented_unsafe_blocks #665

Handled without an issue

• docs(field-availability): clarify since values when availability narrows #657 (open PR, not merged yet) corrects the field-availability since versions and adds a release gate for them.
• Alert fan-out (write_alert plus active response) is repeated in six places; one shared emitter is a single PR.
• Configuration defaults are declared twice, but loader_defaults_match_the_documented_defaults already keeps them in step.