README stated that a crate may only depend on layers to its left, but
nothing checked it, and the wording was self contradicting: the example
given for a cross layer jump was a reverse dependency. Clarify the rule,
add scripts/check-layers.sh to enforce it, run it in CI, and record the
boundary cases in docs/design/layers.md.