chore(ci): run the knip dead-code gate for the repository root and every workspace

[orangeCatDeveloper]

Summary

Stacked on #4938 (the dead-code deletions); this draft carries the gate configuration and CI wiring. Until #4938 merges, the diff below shows both PRs combined; after it merges, this PR's delta is exactly knip.json + ci.yml.

• knip.json gains per-workspace configs for runtime, runtime-host, storage, core, mcp, computer-use, eval, cli and website, plus the repository root (workspaces["."]). Dynamic reachability is registered explicitly — spawn-loaded test fixtures, the filesystem worker bundle entry, the PowerShell-driven Windows IPC trust fixture, eval's Python-spawned harness entry, the dynamically dispatched computer-use command modules, and the two modules that actions/github-script loads from with: blocks (knip's github-actions plugin only reads run: steps) — so the scan doesn't guess.
  so the scan doesn't guess. The runtime-host workspace also carries a file-scoped ignoreIssues entry accepting the knip duplicates finding for the three intentional protocol alias files kept by chore(cleanup): drop verified dead exports and unused types #4938 (the encode/decode result-codec pairs and the PAGE/RANGE bound pair): probe-verified that with the exception an injected unused export in artifact.ts is still reported, so only duplicates is silenced and only in those three files.
• ci.yml replaces the two existing per-workspace Knip steps with a single plain npx knip: a strict superset that covers the root plus all 11 workspaces in ~2s and respects every workspace's project patterns. The step fails when a package.json workspace is missing from knip.json, so a newly added workspace cannot silently enter the repo ungated.
• website keeps its exact cookie@2.0.1 pin declared as an ignored dependency: astro's prerenderer imports { parseCookie } from 'cookie' and vite resolves the bare specifier through the website root, so the workspace pin decides which copy loads.
• Hoisted build/test tooling that root scripts import (electron, electron-builder, electron-updater, app-builder-lib, builder-util, @playwright/test, @babel/parser, ws) is declared in the root package.json with the versions the tree resolves — instead of blanket-silenced, so a hoisting change that would break check:tui-copy or the packaging scripts surfaces as a knip finding. patch-package stays the one silenced exception: apply-dependency-patches resolves it through createRequire by design, so the gate cannot see that use.
• The CI step additionally guards the coupling this declaration created: the root pins for electron-builder's internal packages must track electron-builder's own requirement, or the deep-import packaging tests would silently verify an old archive algorithm while the real build uses a new one.
• packages/ui/scripts joins the project set (a benchmark script sat in the gate's blind zone), and the two intentional exceptions are documented in the CI step itself so the reasons persist in-repo.
• Known coverage boundary: files surfaced through a package.json exports map are entry files, so their unused exports sit outside knip's default report (core exposes 147 of 266 source files this way, runtime 110 of 506, storage 55 of 249); --include-entry-exports surfaces ~250 public-API findings that need their own sweep with explicit keep decisions.

Verification

npx knip (plain)                       → 0 findings (root + all 11 workspaces, ~2s)
gate sensitivity probe                 → an unimported src/copy file and an unused packages/mcp file are both reported
package.json ↔ knip.json coverage assert → implemented in the CI step
duplicates probe                       → injected unused export in artifact.ts still reported with the alias-file exception

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — knip.json workspace configuration, the scan/verification loop (probe-tested coverage), CI wiring, and this description.

Checklist

• Lint, format, typecheck and the affected suites pass locally
• Commit carries Generated-by: Claude Code

Does this PR entail a change in behavior?

• Yes
• No