chore: retire completed-migration scaffolding, wire orphaned boundary check (#4719)

The ecstore/global-state migrations are done (backlog#815, #939, #1052 all
closed). Review of every migration-era test/gate measure found three things
actually retirable or broken — everything else is a live anti-regression
guard and stays.

Remove:
- scripts/check_metrics_migration_refs.sh — guards a migration that
  finished: rustfs_metrics:: has zero hits, the metrics crate no longer
  exists, and the script was never wired into CI or make (only reference
  was one line in config-model-boundary-adr.md, also removed).
- crates/obs init_metrics_collectors — the "backward-compatible alias kept
  during migration" the removed script was guarding. Zero callers; pure
  delegate to init_metrics_runtime.

Archive (docs/superpowers/plans/, continuing the 2026-07 convention,
with the standard archived banner):
- startup-timeline.md, scheduler-baseline.md,
  profiling-numa-capability-inventory.md,
  kms-development-defaults-inventory.md — one-shot snapshots whose only
  consumer is the already-archived migration-progress ledger (their
  same-dir links there start resolving again after the move); zero script
  pins; fed the closed backlog#660/#665 architecture-review ledger.
  Fixed the one outbound link (startup-timeline -> readiness-matrix) that
  the move would have broken — check_doc_paths.sh deliberately does not
  scan plans/, so nothing else would have caught it.

Wire (found orphaned by the same review):
- scripts/check_extension_schema_boundaries.sh guards a live contract
  crate but was never invoked anywhere. Add lint-fmt.mak target, include
  in pre-commit/pre-pr/dev-check, add ci.yml Quick Checks step (job
  already installs ripgrep), sync the CONTRIBUTING.md enumerated list,
  and harden the script against a silently-passing rg probe when src/
  is missing.

Keep (verified live, documented so the next cleanup pass does not repeat
this analysis):
- scripts/check_architecture_migration_rules.sh — added a header stating
  it is a permanent boundary guard, not retirable migration scaffolding;
  'migration' in the name is historical.
- check_migration_gate_count.sh + floor, delete-marker e2e proof, all
  pinned docs, compat-cleanup-register sync, remaining inventories
  (referenced by live docs).

Verification: all 7 guard scripts pass, actionlint clean,
cargo check --workspace (excl e2e) clean, cargo fmt --check clean.
Adversarially reviewed by two independent skeptic passes; their 7
findings (alias left behind, broken outbound link, missing banners,
wrong backlog attribution, CONTRIBUTING drift, rg exit-2 hole, missing
header rationale) are all folded in.

docs/architecture/README.md

@@ -51,12 +51,12 @@ Two rules keep this directory healthy:
 - [obs-ecstore-dependency-inventory.md](obs-ecstore-dependency-inventory.md)
 - [background-services-inventory.md](background-services-inventory.md)
 - [admin-route-action-snapshot.md](admin-route-action-snapshot.md)
-- [startup-timeline.md](startup-timeline.md)
-- [scheduler-baseline.md](scheduler-baseline.md)
-- [profiling-numa-capability-inventory.md](profiling-numa-capability-inventory.md)
-- [kms-development-defaults-inventory.md](kms-development-defaults-inventory.md)
 - [compat-cleanup-register.md](compat-cleanup-register.md)
 
 Historical plans and trackers (rebalance/decommission phases,
 migration-progress ledger) were moved to
-[`docs/superpowers/plans/`](../superpowers/plans/) in 2026-07.
+[`docs/superpowers/plans/`](../superpowers/plans/) in 2026-07. One-shot
+migration snapshots whose only consumer was that ledger (startup timeline,
+scheduler baseline, profiling/NUMA capability inventory, KMS development
+defaults inventory) followed once the architecture-review ledger they fed
+closed out (backlog#660/#665).

docs/architecture/config-model-boundary-adr.md

@@ -173,7 +173,6 @@ Before pushing an extraction PR, run:
 - `cargo tree -p rustfs-ecstore --edges normal`
 - `./scripts/check_layer_dependencies.sh`
 - `./scripts/check_architecture_migration_rules.sh`
-- `./scripts/check_metrics_migration_refs.sh`
 - `cargo fmt --all --check`
 - `make pre-commit`
 

docs/superpowers/plans/kms-development-defaults-inventory.md

@@ -1,3 +1,7 @@
+> **Archived migration snapshot** — moved from `docs/architecture/` (2026-07)
+> when the architecture-review ledger it fed closed out. Kept for history; not
+> maintained.
+
 # KMS Development Defaults Inventory
 
 This inventory tracks `KMSD-001` for

docs/superpowers/plans/profiling-numa-capability-inventory.md

@@ -1,3 +1,7 @@
+> **Archived migration snapshot** — moved from `docs/architecture/` (2026-07)
+> when the architecture-review ledger it fed closed out. Kept for history; not
+> maintained.
+
 # Profiling And NUMA Capability Inventory
 
 This inventory covers `G-013` for `rustfs/backlog#667`. It records the current

docs/superpowers/plans/scheduler-baseline.md

@@ -1,3 +1,7 @@
+> **Archived migration snapshot** — moved from `docs/architecture/` (2026-07)
+> when the architecture-review ledger it fed closed out. Kept for history; not
+> maintained.
+
 # Scheduler Baseline Inventory
 
 This inventory covers `G-011` for `rustfs/backlog#675`. It is a docs-only

docs/superpowers/plans/startup-timeline.md

@@ -1,3 +1,7 @@
+> **Archived migration snapshot** — moved from `docs/architecture/` (2026-07)
+> when the architecture-review ledger it fed closed out. Kept for history; not
+> maintained.
+
 # Startup Timeline Baseline
 
 This document records the current binary startup order before runtime/lifecycle
@@ -33,7 +37,7 @@ new startup semantics.
 | `RUN-007` | `rustfs/src/startup_storage.rs` | Publish endpoints and erasure type. | Updates global endpoints and erasure type. | Non-fatal in this path. | None |
 | `RUN-008` | `rustfs/src/startup_storage.rs` | Initialize local disks, prewarm local disk id map, and initialize lock clients. | Opens local disk state, primes disk id lookup, and creates global lock clients. | Local disk init is fatal; prewarm and lock-client setup are non-fatal in this path. | None |
 | `RUN-009` | `rustfs/src/startup_server.rs` | Initialize capacity management and service state manager. | Starts capacity management and moves service state to `Starting`. | Non-fatal in this path. | None |
-| `RUN-010` | `rustfs/src/startup_server.rs` | Start S3 HTTP listener and optional console listener before storage is ready. | Starts HTTP servers with readiness gates; console listener starts only when enabled and configured. | Fatal if a configured listener cannot start. | Requests remain gated until full readiness except probe/admin/console/rpc/tonic/table-catalog exempt paths; see [`readiness-matrix.md`](readiness-matrix.md) |
+| `RUN-010` | `rustfs/src/startup_server.rs` | Start S3 HTTP listener and optional console listener before storage is ready. | Starts HTTP servers with readiness gates; console listener starts only when enabled and configured. | Fatal if a configured listener cannot start. | Requests remain gated until full readiness except probe/admin/console/rpc/tonic/table-catalog exempt paths; see [`readiness-matrix.md`](../../architecture/readiness-matrix.md) |
 | `RUN-011` | `rustfs/src/startup_storage.rs` | Create cancellation token and initialize `ECStore`. | Creates the runtime cancellation token and storage engine. | Fatal if `ECStore::new` fails. | None |
 | `RUN-012` | `rustfs/src/startup_storage.rs` | Initialize ECStore config and global config system. | Initializes ECStore config, attempts server-config migration, then retries global config init up to 15 times. | Migration attempt is non-fatal in this path; global config init becomes fatal after retries. | Marks the `GlobalReadiness` `StorageReady` stage after global config init succeeds; later runtime readiness still rechecks storage, IAM, lock quorum, and gated peer health before `FullReady` |
 | `RUN-013` | `rustfs/src/startup_storage.rs` and `rustfs/src/startup_services.rs` | Start replication and KMS systems. | Starts background replication pool, then initializes KMS from startup services. | Replication init is non-fatal in this path; KMS init is fatal on error. | `StorageReady` stage is already marked; dynamic runtime storage readiness is still checked before `FullReady`; KMS compatibility readiness remains feature-gated health behavior |