fix: integrate upstream checkpoint 5fe5c6fe9bb7

[Nurozen]

Integrates upstream checkpoint 5fe5c6f (six commits, pingdotgg#10166 to pingdotgg#10171): the Knip export-privatization sweep across packages/shared, packages/client-runtime and packages/contracts, plus the widened knip:check CI gate that now reports unused runtime exports in every internal package and loads scripts/knip-schemas.ts as a preprocessor so Effect schema exports stay allowed.

Problem: the fork's own exports had never passed this gate, and several upstream un-exports collided with fork rebrand lines. Result: the gate passes on the merged tree with no runtime behavior change.

Merge resolution:

• Ten conflicts, all upstream's visibility change with the fork's Lecturn string (externalLauncher.ts, Sidebar.logic.ts, MessagesTimeline.logic.ts, gitActions.ts, threads.ts, environmentHttp.ts, relayClient.ts, schemaYaml.ts, four hunks in rpc.ts where fork-only RPC blocks sat next to un-exported upstream lines). state/vcsStatus.ts deletion accepted; nothing imports it.
• buildEnvironmentAuthHeaders stays exported in client-runtime because fork-only state/contextual.ts imports it.
• knip.jsonc: the auto-merge created a duplicate scripts workspace key that hid upstream's knip-schemas.ts entry; folded into the fork's single block.
• 62 fork-only exports flagged by the new gate are now module-private (42 Ws*Rpc consts in contracts/rpc.ts, 4 DEFAULT_STAVE_* in settings.ts, RelayDecisionsGroup, 15 stave/contextual/relay symbols in client-runtime). Every one is still used inside its own file; only the export keyword was removed. Two dead export { captureReason } re-exports in apps/web and apps/mobile ContextualHostSettings.logic.ts were dropped.
• scripts/package.json gains typescript: catalog:; lockfile validated with a frozen install.

Checks: knip:check exit 0; typecheck clean in shared, contracts, client-runtime, server, web, desktop, mobile, scripts; 58 focused test files, 1048 passed, 1 skipped, 0 failed; lint and vp fmt --check clean over the 79 changed source files. No UI changes.

🤖 Generated with Claude Code

Integrates 6 upstream commits through 5fe5c6fe9bb72c6e8ce9c1724a3887381d3f5cf7. End of the six-commit Knip export-privatization sweep (pingdotgg#10166-pingdotgg#10171): five refactors un-export runtime helpers in shared, client-runtime and contracts, and pingdotgg#10171 adds the knip:check CI gate that enforces them. Landing the sweep with its gate in one merge keeps the tree coherent; stopping before pingdotgg#10171 would privatize exports without the check, and extending further mixes in unrelated UI work (ProviderInstanceCard, mobile work-log, usage limits) that needs separate evidence. Scope: 6 newly reachable first-parent commits on the pinned mirror, 68 source files, +520/-548 lines excluding .repos and pnpm-lock.yaml. Expected conflicts: packages/contracts/src/rpc.ts (upstream 382-line rewrite vs 17 fork hunks of fork-only RPC groups; keep fork exports that fork code imports, take upstream's privatization). Silent clean-merge break: pingdotgg#10167 un-exports buildEnvironmentAuthHeaders in packages/client-runtime/src/state/environmentHttpAuth.ts but fork-only state/contextual.ts imports it; keep that export. All other removed exports were scanned against fork-only files with no usages found. knip.jsonc/package.json fork hunks are at different lines from upstream's rules/scripts/--preprocessor additions; keep fork ignore entries and version, regenerate pnpm-lock.yaml for the new scripts/package.json typescript devDependency. Verify with knip:check on the merged tree plus affected typechecks; no UI evidence needed. merge-tree dry run was blocked by the read-only object store, so conflict list is from hunk-range comparison.

Fresh independent review approved tree fd44e13ad365992437b184851e355fbfda8c3172 after controller-rerun focused checks. Merge commit required; no squash/rebase.

Implemented and independently reviewed by fresh Claude Code agents on the operator's default model, with a Grok outside reviewer.