fix: address review feedback on dependency allowlist

Fixes:
- Single source of truth: script now parses allowlist from CONVENTIONS.md
- Fail closed: script exits non-zero if 'go list' fails
- Direct deps only: uses '-f' flag to exclude transitive deps
- Added 'precommit' to .PHONY in Makefile
- Removed unused ALLOWED_PATTERN variable
- Added Scope column to distinguish test-only vs production deps
- Clarified that transitive deps of approved packages are allowed
- Added note that enforcement script parses the table

CONVENTIONS.md

@@ -7,18 +7,22 @@
 
 ### Approved Third-Party Packages
 
-| Package | Use Case |
-|---------|----------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) |
-| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) |
+| Package | Use Case | Scope |
+|---------|----------|-------|
+| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |
 
 **Any import not in this table or the Go standard library is forbidden.**
 
+Transitive dependencies of approved packages are automatically allowed.
+
 To request a new dependency:
-1. Open a PR that ONLY updates this table with justification
+1. Open a PR that ONLY updates this table
 2. Requires explicit approval from Aaron
 3. After merge, a separate PR may use the package
 
+*Enforcement: `scripts/check-deps.sh` parses this table — update only here.*
+
 ## Error Handling
 
 - Return errors; never panic.