docs: add wait-for-checks CLI command, ADR-0002, update architecture docs

Phase 1e-f of REFACTORING-PLAN.md:

- Register `devx ci wait-for-checks` in cli.py with test coverage
- Add ADR-0002 documenting the ansible_checks consolidation and
  wait_for_checks extraction decisions
- Update AGENTS.md package structure to reflect ansible_checks/
  subpackage and deprecated ci/discover_runners wrapper
- Update docs/user/cli-commands.md with wait-for-checks documentation
  and discover-runners deprecation notice
- Update docs/tech/architecture.md with new modules and canonical
  discover_runners location
- Update docs/mapping.json with ADR entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

AGENTS.md

@@ -98,7 +98,9 @@ src/devx/
 │   ├── record_deployed_tag.py  # Record deployed tag to Gitea repo variable
 │   ├── cancel_superseded_runs.py  # Cancel in-flight CI runs for the same PR branch
 │   ├── check_workflow_artifact_deps.py  # Verify artifact download jobs depend on upload jobs
-│   └── check_workflow_tofu_init.py  # Verify tofu-state jobs have a tofu-init step
+│   ├── check_workflow_tofu_init.py  # Verify tofu-state jobs have a tofu-init step
+│   ├── discover_runners.py  # Deprecated wrapper → molecule/discover_runners
+│   └── wait_for_checks.py  # Poll Gitea Actions for job completion (replaces inline shell polling)
 ├── tools/               # Developer tooling modules (run locally or by CI)
 │   ├── setup.py         # Environment setup (venv, deps, hooks)
 │   ├── install_tools.py # Install actionlint, git-cliff, act_runner, tea, hadolint, vale
@@ -122,12 +124,19 @@ src/devx/
 │   ├── pr_label.py          # Add labels to PRs (idempotent)
 │   ├── pre_push_check.py    # Validate Vikunja task existence before push
 │   ├── check_docker_init.py  # Check Docker Compose services with healthchecks have init: true
-│   ├── check_ansible_set_fact_to_json.py  # Check set_fact tasks don't misuse to_json
+│   ├── check_ansible_set_fact_to_json.py  # Thin wrapper → ansible_checks/set_fact_to_json
 │   ├── check_alert_rules.py  # Validate Prometheus alert rules with promtool
-│   ├── check_ansible_no_log.py  # Check Ansible tasks for missing no_log on secrets
-│   ├── check_ansible_patterns.py  # Detect dangerous failure-masking patterns
-│   ├── check_jinja_expr.py  # Validate Jinja2 expressions in Ansible files
-│   ├── check_ansible_no_state_absent_on_db.py  # Prevent state:absent on DB paths
+│   ├── check_ansible_no_log.py  # Thin wrapper → ansible_checks/no_log
+│   ├── check_ansible_patterns.py  # Thin wrapper → ansible_checks/patterns
+│   ├── check_jinja_expr.py  # Thin wrapper → ansible_checks/jinja_expr
+│   ├── check_ansible_no_state_absent_on_db.py  # Thin wrapper → ansible_checks/no_state_absent_on_db
+│   ├── ansible_checks/     # Composable Ansible check subpackage (canonical implementations)
+│   │   ├── _shared.py      # AnsibleFileFinder, AnsibleYAMLParser, ViolationReporter
+│   │   ├── no_log.py       # Check missing no_log on secret-handling tasks
+│   │   ├── patterns.py     # Detect dangerous failure-masking patterns
+│   │   ├── set_fact_to_json.py  # Check set_fact tasks don't misuse to_json
+│   │   ├── no_state_absent_on_db.py  # Prevent state:absent on DB paths
+│   │   └── jinja_expr.py   # Validate Jinja2 expressions in Ansible files
 │   └── _shared.py           # Shared tool utilities
 ├── opentofu.py          # OpenTofu output helpers (get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field)
 ├── utils/               # Shared utilities (reusable across projects)
@@ -143,7 +152,7 @@ src/devx/
 │   ├── ui.py             # say() — unified click.echo + logging output
 │   └── jinja.py          # Jinja2 environment helpers + Ansible-compatible filters
 └── molecule/            # Optional molecule testing helpers (for Ansible projects)
-    ├── discover_runners.py    # Dynamic Gitea runner discovery
+    ├── discover_runners.py    # Dynamic Gitea runner discovery (canonical; ci/discover_runners is a deprecated wrapper)
     ├── distribute_molecule.py # Distribute molecule scenarios across runners (LPT scheduling, --roles-root for multi-role)
     ├── molecule_ci_guard.py   # Run molecule with cross-runner fail-fast (--roles-root)
     ├── molecule_all.py        # Run all molecule scenarios locally