fix(p1,p0): restore the pre-P1 range contract for two callers; docs link and maintainer paths

The full suite after the replay found regressions from 062a7b7 and 94e96c6:
- catalog_gen and candidates.labeled_spans still unpacked 3-tuples and expected None on a parser
  rejection; source.ranges returns FunctionRange (4 fields, module entry first) and raises ValueError.
- ranges_from_ir passed the language to declarator_name, so the repo-facts declaration table named a
  callback call (exec(..., function () {) as a function; the pre-P1 call had no language.
- the catalog_gen fail-loud test blocked the old module name.
- docs: a renumbered examples anchor, and two .kiro paths in the public threat model.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/openultrasast/model/candidates.py

@@ -379,7 +379,7 @@ def labeled_spans(
     wanted.discard("")
     found: list[tuple[str, int, int]] = []
     for path, entries in ranges.items():
-        for name, start, end in entries:
+        for name, start, end, *_kind in entries:
             if name in wanted:
                 found.append((path, start, end))
     return tuple(found)

src/openultrasast/source.py

@@ -238,7 +238,7 @@ def ranges_from_ir(ir: FileIR, text: str) -> tuple[FunctionRange, ...]:
         if fn.name == MODULE_FUNCTION:
             continue
         line = lines[fn.start_line - 1] if 0 < fn.start_line <= len(lines) else ""
-        declared = declarator_name(line, ir.language)
+        declared = declarator_name(line)  # the declaration tables would name a callback call (`exec(..., function () {`)
         name = declared or fn.name
         if (
             name in RESERVED_FUNCTION_LABELS