feat(guards): add GR-SEC-010 — output escaping enforcement in views

Add architecture test ViewLayerOutputEscapingContractTest that flags
raw <?php echo in .phtml files. Legitimate uses (pre-built ARIA attrs
from navActive(), hardcoded role values, pre-rendered HTML fragments)
must carry an inline // raw-html-ok: reason marker.

Annotated all 11 existing raw echo sites with justification markers.
Added guard to catalog, enforcement map (automated), CLAUDE.md security
section, and never-do-this list.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.agents/checks/guard-enforcement-map.json

@@ -168,6 +168,13 @@
         "tests/Architecture/ApiResourceContractTest.php",
         ".agents/runs/<TASK>/review-security.json"
       ]
+    },
+    {
+      "guard_id": "GR-SEC-010",
+      "enforcement_mode": "automated",
+      "evidence_source": [
+        "tests/Architecture/ViewLayerOutputEscapingContractTest.php"
+      ]
     }
   ]
 }