chore: remove dead code and enable the unused linter

[vishr]

Removes every callerless symbol found by the audit in #50 (items 7 and 8), and turns on the linter that would have caught them, so the next one fails the build it arrives in.

868 deletions, 38 insertions.

Removed

internal/engine/protection_units.go and its test, 527 lines. ProtectionUnitTarget had no implementation outside the in-memory test double, and nothing in cmd/ or internal/ reached GenerateProtectionUnits, ReconcileProtectionUnits, or InspectProtectionUnits. Live systemd unit management stays with internal/engine/schedule.go, which is reachable and covered.

Worth recording before it leaves the tree: the two files encoded different ownership rules for the same host resource, and the deleted one had the stronger scheme — X-Onebox-* unit metadata plus an explicit refusal to overwrite a foreign-owned unit, against schedule.go matching on filename prefix alone. That difference is #50's item 5, not this change's; the code is recoverable from history if that work resumes.

Eleven exported symbols with zero references anywhere in internal/, cmd/, or e2e/: release.Activate (superseded by the manifest activation path), app.Spec.ComposeRefsOf, app.Rendered.Runnable, app.SortedRouteKeys, app.Names.ProtectionTimer (the ForEnvironment variant is the live one), transport.NewSSH (superseded by NewSSHContext), onebox.LoadMigrationBackupOverride, onebox.SaveScheduledOperationEnvelope, onebox.ScheduledArtifactsAsProtectionResources, onebox.ActiveVolumeRecord.Selection, and InspectProtectionUnits with the file above.

The thirteen unexported symbols unused reported, including the status-output sanitisation layer in internal/onebox/status.go.

Enforcement

.golangci.yml held unused back with a note saying the findings were staged work and that deciding their fate "is not this gate's call". That call is now made, so the note and the exemption both go.

The config change was verified rather than assumed: adding func zzDeadProbe() int { return 1 } to internal/engine/plan.go and running golangci-lint run ./internal/engine/... reports plan.go:529:6: func zzDeadProbe is unused (unused).

unused does not see exported identifiers, which is the gap that let all eleven accumulate. just dead-exports covers that half and reports checked 362 exported identifiers, 0 unreferenced. It is deliberately outside check and ci: an exported helper may legitimately land before its caller, and the match is on identifier name alone, so two types with a same-named method count as one. A report that under-counts is a good prompt to go and look and a bad rule to fail a build on.

Left in place on purpose

DeploymentProposal.Preconditions (internal/onebox/types.go:134) is still declared. proposalPreconditions was the only thing that could populate it and it was dead, so the field has always serialised as its zero value — but it is part of the published proposal schema, which makes removing it a schema change rather than a cleanup.

statusIssueCodes, canonicalStatus and statusDigest survive because tests reference them. With sanitizeStatus and proposalPreconditions gone they have no production caller, so status.go is now a test-only island of 95 lines. unused counts them used and will not flag it.

What I ran

• just check — fmt, vet, test, docs-generate-check, site-build: all checks passed
• golangci-lint config verify and golangci-lint run ./... — 0 issues
• go test -race -count=1 ./... — pass
• just vuln — 0 vulnerabilities in reachable code
• just dead-exports — 0 unreferenced

What I did not run

• just e2e. The Docker end-to-end suite was not run locally; CI runs it as its own job.

Refs #50

🤖 Generated with Claude Code