v3.10.0: stable type-aware TypeScript analysis

Stable type-aware TypeScript analysis

--type-aware opts into a bounded TypeScript-Go semantic pass that runs after
Fallow's normal project analysis. It landed in 3.8.0 as an explicit,
repository-only proof; it is now a stable optional contract with a versioned
wire protocol and a packaged companion. Default analysis stays fast, syntactic,
and independent of Node.js and TypeScript.

npm install --save-dev fallow
npx fallow dead-code --unused-class-members --type-aware

npm installs receive the exact matching fallow-type-aware companion as an
optional dependency, so there is nothing else to wire up. See the
type-aware analysis guide.

The pass covers five project-wide capabilities:

• exact symbol-use, TypeScript contract, and validated framework-contract
  decisions for existing dead-code candidates
• symbol traces across namespaces, aliases, and re-export hops
• package API surfaces and cross-file private type leaks
• exact-symbol impact paths and targeted-test suggestions
• advisory public-signature type coupling

Fallow only changes a finding when the checker resolves an exact declaration
identity. Name-only matches are never enough, so dynamic computed access,
decorators, dependency injection, and runtime registration keep their findings.

Cross-project confirmation

Explicit TypeScript projects are now scanned together, so a use in an
application project can confirm a declaration in a referenced library project.
String-literal element access is recognized as a use. Explicit solution configs
without source files fail closed with per-candidate abstention instead of
emitting invalid project metadata.

Checker-backed API and project metadata

Public API analysis no longer treats parameter names or generic type parameters
as private types, complete semantic results drop unmatched syntactic leak
guesses, and overlapping TypeScript projects no longer duplicate API entries or
coupling edges. Per-project candidate, confirmed, unresolved, and abstained
counts are populated instead of staying zero, including in the programmatic API.

Unavailable API queries keep their syntactic leak findings, a missing entry
point keeps mixed-entry results partial, requests above the private-leak
candidate cap retain the unrequested tail and report partial capacity, and
unexpected checker failures surface as errors instead of being mislabeled as
unsupported syntax.

The semantic protocol is now version 6, the first stable type-aware wire
contract. A canonical manifest keeps Rust, the sidecar, corpus tooling, and
editor packaging aligned, and pre-stable protocol variants are rejected.

Full Changelog: v3.9.1...v3.10.0