refactor: decompose seven more WS-D god-files by role (database, alerts, registry, netif, iperf installer)

[krisarmstrong]

Summary

Second bundled WS-D god-file decomposition — seven independent pure-move
splits, one commit each, every file relocated by role with no behavior
change:

Original (LOC)	Split into
internal/database/repository_topology.go (720)	repository_topology.go (nodes + ARP bindings) · repository_topology_links.go (links/targets) · repository_topology_interfaces.go (interfaces)
internal/database/database.go (684)	database.go (DB type, config, open/recovery, lifecycle) · repositories.go (per-repository accessor methods)
internal/alerts/pipeline/observation_pipeline.go (669)	observation_pipeline.go (lifecycle) · observation_prime.go (history priming) · observation_eval.go (per-kind eval)
internal/alerts/pipeline/listener_pipeline.go (654)	listener_pipeline.go (lifecycle + package doc) · listener_rules.go (rule load/snapshot) · listener_eval.go (event eval)
internal/discovery/registry.go (616)	registry.go (type, lifecycle, queries) · registrymerge.go (field-merge helpers)
internal/netif/interfaces.go (604)	interfaces.go (inventory/management + package doc) · select.go (auto-detect, candidate selection, link status)
internal/diagnostics/iperf/installer.go (698)	installer.go (package-manager detection) · install.go (install/build/download execution)

Bundled into one PR to avoid the required-up-to-date branch-protection merge
cascade. Every split file is now under the 600-line size gate. Package doc
comments retained in the kept core file; no underscores introduced beyond the
package's existing repository_*/*_pipeline conventions.

Linked Issue

Related to #187

Type of Change

• Chore / refactor / dependency update

Risk

• Low

Testing Evidence

Each split independently verified pure-move (declaration sets + code-line
multisets identical to the original), then the combined bundle gated from
a clean worktree off origin/main:

per-file pure-move proofs (×7):   ✅ DECL + CODE IDENTICAL
gofmt -l:                         clean
go build (all affected pkgs):     OK
go vet (all affected pkgs):       OK
golangci-lint (all affected):     0 issues
go test -race alerts/pipeline:    ok
go test -race netif:              ok 63.8s
go test -race iperf:              ok
check-filename-policy.sh:         ✓
file-size gate:                   all touched/new files <600

The slow discovery and database -race suites are left to CI (full
-race with the 20m timeout); both are pure relocations with no logic or
goroutine changes.

Security and Release Checklist

• No secrets, tokens, credentials, or customer data are included.
• Mutating routes, auth surfaces, permission checks, and output encoding were reviewed if touched. (none — pure file splits; SQL/repository code relocated verbatim)
• Dependencies are pinned and justified if changed. (none changed)
• Documentation, screenshots, or operator notes were updated if behavior changed. (no behavior change)

[github-actions]

📋 License Compliance Report

✅ All dependencies pass license compliance checks

Go Dependencies

• Unknown: 118 package(s)
• MIT: 30 package(s)
• BSD-3-Clause: 17 package(s)
• Apache-2.0: 12 package(s)
• BSD-2-Clause: 2 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)