v1.21.16 — Dead-code remediation (S7) & API-key client consolidation

Maintenance release — no user-facing feature change, no DB migration.

Removed — Dead-code remediation (ADR-107)

~13,600 lines of proven-dead code removed in five verified clusters:

• the v3 autonomy engines (autonomous_executor, feedback_loop, relevance_engine + inert configs, 9 settings fields and env vars),
• the plan-level approval framework (plan_editor, approval strategies, the dead schema classes) and the 987-line hitl_orchestrator ghost service (instantiated but never called) with its hitl/policies package,
• the fluent manifest_builder, the parallel state_keys constants, the contacts-v2 models,
• dead observability: 18 orphaned Prometheus metrics, 11 recording rules, 7 alerts, 23 no-data Grafana panels,
• every phantom test (they exclusively covered removed code — live coverage unchanged) and the i18n_v3 orphan block.

Each deletion was proven safe by import-graph closure analysis, runtime "simulated deletion" (full suite with the modules blocked at import time) and fresh-container boots. Live boundaries were kept and are documented (approval-gate pass-through stays wired; PlanSummary/PlanApprovalInteraction remain the HITL registry fallback).

Changed — API-key client consolidation (ADR-108)

The Brave, OpenWeatherMap and Perplexity clients now inherit a hardened BaseAPIKeyClient:

• Redis-backed per-user rate limiting (multi-worker correct, local fallback),
• shared per-service circuit breaker (new public CircuitBreaker.check() — private-API usage eliminated from the api-key, oauth and apple bases),
• retry with backoff (429 Retry-After HTTP-date tolerant; malformed-200 bodies retried),
• domain error taxonomy instead of raw HTTPExceptions.

Constructors, signatures and error contracts are pinned by 37 characterization tests written against the legacy implementations and kept byte-identical through the migration.

Fixed

• Pooled HTTP client socket leak: new ToolDependencies.aclose() closes cached connector clients deterministically at end of run; direct call sites got try/finally closes.
• Order-dependent circuit-breaker test failures (shared registry state) isolated with an autouse fixture.
• 17 living docs synced with the removals (HITL.md, AGENT_MANIFEST.md, TOOLS.md, architecture docs, test READMEs…).

Verification

~10,147 backend tests green with zero new failures at every checkpoint; Ruff/Black/MyPy strict clean repo-wide; i18n parity across all 6 locales; five healthy fresh container boots; /metrics verified (kept metrics present, removed metrics absent).