fix(p1,p0): restore the pre-P1 range contract for two callers; docs link and maintainer paths

The full suite after the replay found regressions from 062a7b7 and 94e96c6:
- catalog_gen and candidates.labeled_spans still unpacked 3-tuples and expected None on a parser
  rejection; source.ranges returns FunctionRange (4 fields, module entry first) and raises ValueError.
- ranges_from_ir passed the language to declarator_name, so the repo-facts declaration table named a
  callback call (exec(..., function () {) as a function; the pre-P1 call had no language.
- the catalog_gen fail-loud test blocked the old module name.
- docs: a renumbered examples anchor, and two .kiro paths in the public threat model.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/deployment.md

@@ -148,7 +148,7 @@ files live in `~/.cache/ousast/ax-src/` (`OUSAST_AX_SRC`).
     - An admin must set up the bucket once, as [RustFS setup](rustfs.md) describes. The store verifies
       it at every start.
 
-5. **Run a real Run**, as in [Examples](examples.md#7-running-the-agentic-plane): `ousast plane run
+5. **Run a real Run**, as in [Examples](examples.md#6-running-the-agentic-plane): `ousast plane run
     plane/runs/validation-46.yaml`, then `status` and `remember`.
 
 6. **Tear down** with `ops/ax/down.sh`. It deletes the cluster and its registry.

docs/threat-model.md

@@ -12,8 +12,8 @@ It also lists the controls that keep a scan safe to run in CI and safe to share.
     control flow and data flow) with Joern. It uses `joern-parse`, a parser, not a build.
     Standard mode may send code excerpts to the configured model.
   - No scan mode executes target-derived code any more: the deep-mode REGRESS stage was retired on 2026-10-13
-    and is recorded as `regress_retired`. Execution happens only in the search-with-proof arm's sandbox,
-    described in `.kiro/specs/search-with-proof/`.
+    and is recorded as `regress_retired`. Execution happens only in the search-with-proof arm's sandbox
+    (`src/openultrasast/search/_sandbox.py`).
 - **The ruleset and CWE policy are trusted, governed data.** They change
   through reviewed commits.
 - **Provider credentials are the operator's.** The core install (PyYAML only) makes no network
@@ -94,4 +94,4 @@ internal hunter tools. No tool accepts a free-form command argument.
 
 Retired on 2026-10-13 with the REGRESS stage. The search-with-proof arm runs demos under bubblewrap with
 seccomp, no network unless the oracle needs a namespace, and differential runs against owned canaries;
-see `src/openultrasast/search/_sandbox.py` and `.kiro/specs/search-with-proof/`.
+see `src/openultrasast/search/_sandbox.py`.