[nycomp]

What

#970 phase 3, dist 2 of 5 — campus.model is carved out of the suite exactly like campus.common was in #987: it now ships from the new campus-model v0.1.0 release wheel, and the suite consumes it as a version-pinned URL dependency.

Changes

• campus/model/ deleted from the suite tree (~2.6k lines); pyproject declares campus-model as a wheel dep. Suite wheel verified: no campus/model, still init-less (namespace audit green).
• SHARED_ALLOWED drops the in-repo model entry — the AST boundary rules now govern what in-repo layers import FROM the external campus.model (storage/webauth keep it in their allowed sets, unchanged).
• Tests split like feat(dist): consume campus-common from its own distribution #987: the 10 model behavior suites + the flask-free/template-gone import-weight guard moved to the campus-model repo; the suite keeps a consumer-side flask-free check on the installed wheel.
• Docs: PACKAGING.md (overview, namespace rules, install section), campus/README.md tree, architecture.md + auth-login-flow.md file-path references.

The campus-model repo

• Carved verbatim from weekly 3f04e68; stdlib + campus-common only; flask-free even at call time.
• Interface locked from day one: closed-world __all__ tests, leaf-surface consistency, checked-in interface_manifest.json, strict-0.x versioning policy.
• CI green (Ruff + Unit 3.11–3.13 required, 3.14 signal; fresh-venv wheel smoke resolving campus-common from its release); main ruleset-protected; labels/topics mirrored.
• One accuracy note baked into its README: a plain import campus.model loads bcrypt via credentials' use of campus.common.utils.secret — pre-existing monorepo behavior, documented rather than 'fixed' in the carve.

Verification

• Worktree: unit + contract + integration ALL GREEN; ruff green.
• Fresh-venv wheel smoke: pip resolves the campus-model wheel, namespace-merges under campus, full 38-symbol re-export surface imports.

Refs #970