Fix dead-code false positives for framework/runtime reachability

[orenlab]

Summary

This PR reduces dead-code false positives by teaching CodeClone about deterministic runtime reachability surfaces that do not appear as direct calls.

It covers FastAPI/Starlette routes and dependencies, Django URL patterns, Dependency Injector providers, Typer/Click commands, Celery tasks, top-level __all__ exports, package entry points, Pydantic validator/serializer hooks, Protocol declarations, and explicit ABC inheritance.

Details

• Adds a reachability model for framework and packaging-driven liveness without executing user code.
• Preserves deterministic behavior: no broad name-only heuristics, ambiguous entry-point matches are ignored, and project metadata is limited to repo-local pyproject.toml.
• Bumps cache/report schemas to carry reachability facts consistently across cold and warm runs.
• Updates docs and tests for the new dead-code contract.
• Refreshes project dependencies for the current 2.0.1b1 beta line.

Validation

• uv run pytest --cov=codeclone --cov-report=term-missing --cov-fail-under=99 --cov-report=xml
• uv run --with mkdocs --with mkdocs-material mkdocs build --strict
• uv run pre-commit run --all-files
• CodeClone MCP full run and changed-scope review against main

[github-actions]

CodeClone Review

✅ Passed · Health 90/100 (A) · Baseline ok · Cache miss · CodeClone 2.0.1b1

Review snapshot

Area	Signal	Review note
Clones	0 total, 0 new, 0 known	no new clone debt reported
Quality	CC max 20, CBO max 8, LCOM4 max 3, overloaded 11	structural metric snapshot
Dependencies	avg 4.0, p95 12, max 16, cycles 0	acyclic
Coverage Join	not joined	no coverage.xml facts in this report
Security Surfaces	59 surfaces, 4 categories, 29 production	report-only boundary inventory
API Surface	2232 symbols, 217 modules	0 breaking, 0 added
Dead code	0 high-confidence, 1 suppressed	clean

Review focus

• Treat 29 production security surface(s) as review-first boundary code when touched.
• Review 11 overloaded module candidate(s) when they intersect this PR.

_{Security Surfaces are report-only capability inventory, not vulnerability claims. Generated by CodeClone}