chore(contracts): keep compat DTOs out of `thrust-contracts`; add the `check-deps.sh` rule

Read scripts/check-deps.sh and the cited crate manifests, then trace the DTO and use case references in crates/thrust-contracts/src/lib.rs, crates/thrust-core/src/lib.rs and crates/thrust-api/src/lib.rs. The issue is blocked by #44, so first check that work's status. Done means the DTOs move to the API surface, dependency checks reject compat crates in contracts, ports and core, the docs are updated, and the listed test and control cases pass.

Context

thrust-contracts is the bottom crate of the graph: ids, domain records, the event envelope, the test fixtures, and the slice's HTTP DTOs CreateWorkItemRequest, ApiErrorBody and ApiErrorDetail (crates/thrust-contracts/src/lib.rs:206-230). thrust-ports, thrust-core and thrust-api all depend on it (crates/thrust-ports/Cargo.toml:10, crates/thrust-core/Cargo.toml:10, crates/thrust-api/Cargo.toml:10). The use-case takes the HTTP DTO as its input (crates/thrust-core/src/lib.rs:227-232), and the core tests build it (crates/thrust-core/tests/attachments.rs:23, model.rs:90, outbox.rs:18); the error DTOs are used only by the router (crates/thrust-api/src/lib.rs:47-48). The docs endorse the placement: docs/src/contributing/crates.md:10 puts "a request or error body" in thrust-contracts, and ARCHITECTURE §2a lists "API types" there (ARCHITECTURE.md:148).

Problem

When compat-plane is built (#44), its Plane-shaped types (the 12-key issue-list envelope, per_page:page:is_prev cursors, the "None" group, Plane's error strings) have an obvious home next to the existing DTOs, and from there thrust-core and thrust-ports can import them with no check failing. scripts/check-deps.sh:13-14 forbids runtime and platform crates for CLEAN_CRATES; nothing says which internal crate may depend on which. ADR-0034's Confirmation (lines 45-48) requires the compat crate to be removable when the Dioxus UI lands, and its decision drivers say not to freeze Django-era response shapes into the Rust design (line 21). A core type shaped by Plane's serializers breaks both. ARCHITECTURE line 167 describes the surfaces as route groups composed into thrust-api; if compat-plane is only a module there, no graph check can see it at all.

Proposal

• compat-plane is its own crate, crates/thrust-compat-plane (ARCHITECTURE §2a, line 151), exporting a Router that thrust-api mounts. Every Plane-shaped request and response type lives in it, or in a thrust-compat-types crate if /api/v1 shares them (the home of the plane_500() helper from #51).
• Move CreateWorkItemRequest, ApiErrorBody and ApiErrorDetail into thrust-api. The use-case takes a domain input (for example NewWorkItem) and the handler maps the DTO onto it; the JSON on the wire does not change.
• Add a section to scripts/check-deps.sh in the shape of lines 44-51: for thrust-contracts, thrust-ports and thrust-core, cargo tree -p <crate> -e normal --target all -i thrust-compat-plane (and -i thrust-compat-types) must print nothing. Before trusting an empty answer, the script asserts the compat crate is a workspace member, so a renamed or missing crate fails the check instead of passing it.
• Update docs/src/contributing/crates.md:10 and ARCHITECTURE.md:148 to say HTTP DTOs live with their surface, not in thrust-contracts.

Acceptance criteria

• grep -nE "struct (CreateWorkItemRequest|ApiErrorBody|ApiErrorDetail)" crates/thrust-contracts/src/lib.rs returns nothing; cargo nextest run -p thrust-core is green.
• scripts/check-deps.sh exits 0. With a temporary thrust-compat-plane = { workspace = true } line in crates/thrust-core/Cargo.toml it prints FORBIDDEN: thrust-core depends on thrust-compat-plane and exits 1 (control, shown in the PR).
• With the compat crate removed from the workspace members, the new section exits non-zero instead of reporting "absent" (control for the vacuous pass).
• The contract suite is green on all four targets with no change to its assertions.
• docs/src/contributing/crates.md and ARCHITECTURE.md §2a name the new rule.

References

• Review: .agents/plans/contrail/reviews/2026-10-19-fable-architecture-review.md (FR-20)
• crates/thrust-contracts/src/lib.rs:206-230; crates/thrust-core/src/lib.rs:227-232; crates/thrust-api/src/lib.rs:47-48,183
• scripts/check-deps.sh:13-14,44-51
• ADR-0034 (decision drivers line 21, Confirmation lines 45-48), ADR-0032
• .agents/plans/contrail/ARCHITECTURE.md:148,151,167; docs/src/contributing/crates.md:10,23-24

Blocked by: #44

Finding: FR-20