merge: lane/boundary-refs-p0-20260819 @ 2f7c34c2b2 — all-refs boundary audit, three missing scanner rules (aws_resource_id/cr-/subnet-/ami-), rule-scoped allowlist, severity-ordered all-rules reporting (29 tests; 66 findings pinned unremediated by owner decision)