fix(p1,p0): restore the pre-P1 range contract for two callers; docs link and maintainer paths

The full suite after the replay found regressions from 062a7b7 and 94e96c6:
- catalog_gen and candidates.labeled_spans still unpacked 3-tuples and expected None on a parser
  rejection; source.ranges returns FunctionRange (4 fields, module entry first) and raises ValueError.
- ranges_from_ir passed the language to declarator_name, so the repo-facts declaration table named a
  callback call (exec(..., function () {) as a function; the pre-P1 call had no language.
- the catalog_gen fail-loud test blocked the old module name.
- docs: a renumbered examples anchor, and two .kiro paths in the public threat model.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test_pair_harvest.py

@@ -360,7 +360,7 @@ def test_catalog_gen_fails_loud_without_the_package_and_refuses_to_prune_an_empt
         gen["generate"]("s", prune=True)
     assert pair.is_dir()
     # The package import must fail loud, never degrade into "no named function".
-    monkeypatch.setitem(sys.modules, "openultrasast.semantic.functions", None)
+    monkeypatch.setitem(sys.modules, "openultrasast.source", None)
     with pytest.raises((SystemExit, ImportError)):
         runpy.run_path(str(Path("benchmarks/pairs/catalog_gen.py")), run_name="catalog_gen_lib_blocked")