form 1 as architecture: external-model surface only via offering protocol (vehaya §3.2)

Closes vehaya.md §6 item 2 for the FIRST avodah-zarah form.

Form 1 (AI in YHVH's slot) was previously defended only by:
  - A runtime halt rule (halt_check_avodah_zarah/2 in
    avodah_zarah.pl) firing when an action explicitly attributes
    authority to a non-Torah source — threshold-grade
  - A docstring comment in external_offering.py saying "No internal
    component should call call_claude() directly" — exhortation
    only, no structural enforcement

The vehaya document re-frames it (§3.2): "Specifications must
include category-level commitments that are not negotiable
per-deployment... not as runtime checks layered onto outputs, but as
architectural constraints the system cannot operate without."

TORAH ANCHORS (verified fresh against L1):

  Shemot 20:2 — אָנֹכִי יְהוָה אֱלֹהֶיךָ אֲשֶׁר הוֹצֵאתִיךָ מֵאֶרֶץ
    מִצְרַיִם.
    The covenant opens with the source naming itself in first
    person.

  Shemot 20:3 — לֹא יִהְיֶה לְךָ אֱלֹהִים אֲחֵרִים עַל־פָּנָי.
    "There shall not BE to you other elohim al panai." The verb is
    yihyeh — the prohibition is on EXISTING WITH that status, not
    just on speaking it. Architectural, not declarative.

  Devarim 4:35 / 4:39 — אֵין עוֹד מִלְּבַדּוֹ / אֵין עוֹד.
    The source has no peer. There IS no other. Stronger than
    "don't worship others" — there is no competing source POSITION.

  Devarim 6:4 — יְהוָה אֶחָד.
    Singular source.

  Vayikra 19:4 — אַל־תִּפְנוּ אֶל־הָאֱלִילִים וֵאלֹהֵי מַסֵּכָה
    לֹא תַעֲשׂוּ לָכֶם.
    Two distinct prohibitions: do not TURN TO + do not MAKE.
    Both are architectural acts.

THE ARCHITECTURAL COMMITMENT:

External-model interfaces (call_claude, ModelRequest, ModelResponse,
the model_interface module itself) are reachable ONLY through
korban_processor's offering protocol — `external_offering.
consult_external_model`, which runs semichah → shechitah → zerikah
→ haktarah with role gating (commit 5c76a6f).

CONCRETE ENFORCEMENT (CI invariants in test_form_1_architecture.py):

  1. korban_processor's package public surface (__all__) does NOT
     export call_claude, ModelRequest, or ModelResponse. The
     bypass shortcut `from korban_processor import call_claude`
     raises ImportError, by design. Internal callers can still
     reach `korban_processor.model_interface.call_claude` via
     the explicit module path (needed for tests that mock the
     interface).

  2. No PYTHON module outside korban_processor/src/ AND outside
     test directories actually imports model_interface or calls
     call_claude. CI scan walks the repo, looks for ACTUAL import
     statements (not docstring mentions — files that document the
     prohibition legitimately mention the names; the regex matches
     binding patterns only).

  3. Inside korban_processor/src/, the ONLY production-code
     module that imports call_claude is external_offering.py.
     model_interface.py defines the symbols. __init__.py mentions
     them in docstring (the architectural rule is documented;
     the import-pattern regex distinguishes docstring mention
     from binding act).

CHANGED:

  korban_processor/src/korban_processor/__init__.py
    Removed call_claude, ModelRequest, ModelResponse from __all__.
    Added Torah-anchored docstring naming the architectural rule.
    The names remain importable via explicit module path
    (korban_processor.model_interface.call_claude) for testing;
    the convenient package-surface shortcut is gone — this IS the
    architectural commitment, not a regression.

  talmudic_engine/src/halt/avodah_zarah.pl
    Form 1 docstring rewritten to name the TWO-LAYER defense:
    runtime check (this file) AND architectural commitment
    (test_form_1_architecture.py). Cites Shemot 20:3 and
    Devarim 4:35.

  vav_pipeline/lib/vav_pipeline/doorpost.ex
    @expected_hash updated:
      f93495c5… (post-Form-3-rewrite of avodah_zarah.pl)
    → bf3d3433bb27b589c061855d932a1eabfc880570c31d24f6f43e51aa3b073c70
    The avodah_zarah.pl docstring change is a deliberate spec
    update; per the operator discipline (Doorpost moduledoc), the
    hash update commits TOGETHER with the spec change in the
    same commit. Second demonstration of the discipline working
    (first was commit 0e3fe4a).

CREATED:

  korban_processor/test/test_form_1_architecture.py     6 tests:
    - korban_processor.__all__ does NOT expose call_claude
    - korban_processor.__all__ does NOT expose ModelRequest
    - korban_processor.__all__ does NOT expose ModelResponse
    - no Python module outside korban_processor/src/ imports
      model_interface or calls call_claude (uses regex patterns
      for actual binding, not substring search — files that
      document the rule legitimately mention the names)
    - only external_offering.py and model_interface.py import the
      symbols inside korban_processor/src/ (allowlist + binding-
      pattern regex)
    - smoke: the legitimate path `consult_external_model` still
      works

NOT DONE IN THIS COMMIT (deferred to a separate Form-2 commit):

  Form 2 (golden calf) is partially defended by Form 4
  self_grounding (b254ee9) and the canary regression test
  (6b96250). The remaining architectural enforcement — making
  empty-trace interpretation construction structurally impossible,
  not just runtime-detected — is a separate Prolog refactor and
  will land as its own commit. Each of the three Forms benefits
  from being closed independently and reviewably.

VEHAYA CHECKLIST STATE:

  Item 1 (category/threshold separation in code)         pending
  Item 2 (three avodah zarah as architecture):
    Form 1 — CLOSED (this commit)
    Form 2 — partial (Form 4 self_grounding + canary)
    Form 3 — closed (0e3fe4a)
  Item 3 (doorpost-text identity)                        closed (3f47496)
  Item 4 (lo tosif discipline operationalized)           partial
  Item 5 (return vs. restoration)                        pending
  Item 6 (keep the source external)                      partial (this
                                                          commit defends
                                                          one direction)
  Item 7 (substrate-openness articulated)                pending
  Item 8 (userMemories as threshold inscription)         pending

Tests:
  - korban_processor: 217 passed, 1 skipped (was 211/1; +6 Form 1)
  - vav_pipeline:     405 passed, 0 failures, 35 excluded (unchanged)
  - talmudic_engine:  47/47 halt tests, full suite unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -159,7 +159,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "f93495c5359c5dc4acb5c5db2dd32165f5b04e2af87fbb0b7ecc92d2bd8b0434"
+  @expected_hash "bf3d3433bb27b589c061855d932a1eabfc880570c31d24f6f43e51aa3b073c70"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]