chore(tauri-commands): remove 114 registered commands with no caller

[Chloe-JY]

Problem

src-tauri/src/commands/handler_list.inc registered 1,019 Tauri commands.
A full sweep of that registry against every non-Rust file in the repository
found 145 with no caller in src/, tests/, or src-tauri/capabilities/.

Registering a command is not free: each one keeps its implementation and
everything reachable from it compiled into the binary, exposed on the IPC
surface, and in scope for review, refactors, and audits. Several of these
commands were the last remaining voter for whole modules — a state manager
nothing reads, four HTTP registry clients, four analytics/pagination services
kept alive only by their own tests.

The 145 are not uniformly dead, and this PR removes only the subset that is.
Classifying each by whether Rust itself calls the function:

Class	Count	Handled here
A — no caller anywhere	127	yes (13 landed separately, see below)
B — no frontend caller, but live from Rust	15	no
C — only a test calls it	3	no

Class B matters: the 11 internal_browser_* commands plus
list_internal_browser_targets and get_active_internal_browser_state are the
agent's browser-control tool, invoked as plain Rust functions from
crates/agent-core/src/core/tools/impls/web/control_internal_browser.rs.
cli_agent_run is invoked by agent_sessions::cli::agent_core_bridge,
get_webview_cookies by Cursor session-token capture, get_watch_status by
watch_repos, convert_patch_to_unified by es_convert_patch_to_diff. Their
registration is dead but their function is not — deleting them would break
agent web control and CLI session startup. They are left alone here and belong
in a separate PR that drops the registration and keeps the function.

The 13 benchmark_* commands are class A but ship separately in #1173, because
they are one coherent archived feature with its own .archive/README.md entry.
This PR covers the remaining 114.

Solution

Removed the 114 command functions and their handler_list.inc registrations,
then followed each removal outward and removed what it was the last caller of.
The registry goes from 1,019 to 905 entries; the diff is 8,243 deletions
against 20 insertions.

Whole modules that lost their last voter and are deleted:

• src/infrastructure/index_manager.rs (+ its tests) — IndexManager was
  constructed and app.manage()d in setup_hook::state, but its only readers
  were get_index_status / get_all_indexes / start_indexing /
  release_index. With those gone nothing reads the managed state, so the type,
  its state registration, and its tests go with them.
• crates/agent-core/src/specialization/mcp/registries/ — the hub, smithery,
  mcpbar, and glama MCP-marketplace clients. Every public item in all four
  was a *_search / *_detail / *_install command; nothing outside the
  directory referenced it.
• src/agent_sessions/event_pipeline/{analytics,history,pagination,statistics}.rs
  (+ their four test files) — the services behind es_compute_analytics,
  es_query_session_history, es_paginate_events and friends. After the
  commands went, their only remaining callers were their own tests.
• src/agent_sessions/event_pipeline/commands/{analytics,pagination}.rs — the
  command modules themselves, left holding nothing but a doc comment.
• crates/agent-core/src/specialization/skills/market/browse.rs — the whole
  file was skills_hub_browse plus two imports.

Command families removed in place (implementation deleted, module kept because
live commands remain in it): browser DOM editing / multi-select / element
geometry / standalone browser windows / devtools introspection (28,
dom_editor.rs 801→93 lines, windows.rs 165→30); external-session es_*
analytics, history, pagination, extraction (16); Cursor and Kiro session capture
and token reading (6); cache_* session-cache accessors (7); git bundle
create/apply/push and repo-watch status (14); market-proxy allocation and CA
certificate install/trust (8); skills-hub env storage and install (4); recent-file
menu, work-item transition, team-inbox unread count, PTY cwd, temp dir, file
search by extension, Qdrant debug info, aligned diff, routine-scheduler debug,
and the remaining scattered singles.

Transitively-dead support code removed with them, each verified against
origin/develop to be reachable only from a removed command:
HealthMonitor bulk health, RepoStateStore::get_all_cached_statuses (and its
one test), Watcher::unwatch_all, proxy CA install_ca / is_ca_installed /
uninstall_ca, stat_cursor_cli_history_for_session, get_cursor_sessions with
its two date helpers, git-bundle auto_commit_if_needed and MAX_BUNDLE_SIZE,
external-IDE try_open_app and generate_app_name_variants, work-item
guard_completion (and the one assertion that referenced it), and the
estimate_cost_blended Cursor pricing helper.

Resulting invariant: every entry in handler_list.inc is either reachable from
the frontend or reachable from Rust — no registration exists whose only purpose
is to keep code compiling.

Potential risks

• IPC/wire compatibility. 114 commands leave the invoke surface. A frontend
  calling any of them would now get a runtime "command not found" instead of a
  result. Verified exhaustively (see Verification) that no caller exists in this
  repository, including tests/e2e/ and src-tauri/capabilities/default.json,
  and that the repository has no dynamically-constructed command names.
• Feature loss, not just cleanup. Some of this is a working backend for a
  feature whose UI is gone: browser DOM editing, the MCP marketplace clients,
  the SWE-bench-adjacent es_* analytics services. If any of those UIs is
  planned to return, this PR is the commit to revert or cherry-pick from. That
  is a deliberate call — the alternative is carrying compiled, unreviewed,
  unreachable backends indefinitely.
• Data on disk is untouched. The session cache, git bundles, proxy CA, and
  skill-env JSON written by the removed commands all remain where they were.
  Nothing is deleted from the user's disk; the code that read those files is
  what went away. Restoring the code restores access.
• Proxy CA trust state. proxy_install_cert / proxy_uninstall_cert are
  gone, so a user who already has the ORGII CA in their trust store has no
  in-app way to remove it. They can remove it through Keychain Access. Nothing
  installs a new CA any more either.
• Managed-state removal. app.manage(Arc<Mutex<IndexManager>>) is gone from
  init_core_state. Any future command that asks for that state via
  tauri::State will panic at call time rather than fail to compile — the usual
  Tauri hazard. No such command exists now.
• Test coverage. Five test files are deleted (four event_pipeline service
  suites and index_manager_tests) plus one state_store test and one
  assertion in a work_item_features test. Every one of them exercised code
  deleted in this PR; no test covering surviving behavior was touched.
• Unverified paths. Neither the removed code nor the surviving neighbours
  were exercised at runtime in a built app — this is a static-reachability
  argument backed by a clean workspace build, clippy, and the test suites of
  every touched crate. The strongest residual risk is a caller reaching a
  command through a mechanism no static scan can see; the repository's two
  indirect invoke() sites were both checked and both pass literal constants.
• Rollback: revert this commit. It is self-contained and touches no
  migration, schema, or persisted format.

Verification

Re-verified after rebasing onto develop (805940303), which had since merged
#1172 (semantic-search removal) and #1174 (rspack dev server). Two conflicts,
both resolved by re-deriving rather than hand-merging: semantic_commands/ debug.rs was deleted by #1172 and its deletion accepted (this PR only removed
one function from it), and handler_list.inc was regenerated from the new
develop by re-running the removal script — leaving a diff of exactly 114
registration lines plus one section comment whose only entry is gone. The
unrelated db_browser/tempfile lockfile drift that the rebase pulled in was
dropped, so Cargo.lock is untouched.

• cargo check --workspace --all-targets — clean, zero warnings.

• cargo clippy --workspace --all-targets -- -D warnings — exit 0, post-rebase.

• cargo test --workspace post-rebase — 3,250 passed, plus the pre-rebase
  per-crate run below.

• cargo test for every crate in the diff — advanced_search, agent_cli,
  agent_core, browser, git, integrations, key_vault, orgtrack_core,
  perf_utils, project_management, search, session_persistence,
  system_services, terminal, org2 — 6,450 passed, 0 failed, 27
  ignored (exit 0).

• All cargo commands run with a private CARGO_TARGET_DIR. Two ORGII worktrees
  resolve this package to the same build-script OUT_DIR, so a shared target
  dir verifies the wrong worktree's handler_list.inc — which can produce a
  false green as easily as a false failure.

• Registry sweep. Parsed all 1,019 entries of handler_list.inc and searched
  9,690 repository files (.ts/.tsx/.js/.jsx/.mjs/.cjs/.json/.html/.md/.rs/ .toml/.yml/.yaml, excluding node_modules, target, .archive) for each
  command name. 145 had zero non-Rust hits.

• Rust-caller classification with a fixpoint. For each of the 145, located
  every Rust reference, discarded definitions, use statements (including
  multi-line use {...} blocks) and comments, resolved each remaining site to
  its enclosing fn, then iterated to a fixpoint so a command whose only caller
  is another dead command is itself dead. This is what separates the 127 from
  the 15 that agent-core calls directly.

• Shadowed-name check. Two collisions were caught and corrected: the
  proxy_release command is dead while the proxy_release module in the CLI
  session runner is live and unrelated; IndexManager::get_all_indexes /
  release_index are methods sharing a name with their commands.

• Fallout isolated by differential orphan analysis. Ran an orphaned-pub fn
  scan over src-tauri/ before and after and diffed, so only functions this
  change orphaned were removed. That diff also caught four false positives —
  context_window_hint, get_all_health, ca_exists, get_process_cwd — which
  were restored: the first was already test-only on develop (its last
  non-test mention was a doc comment) and the other three have same-file
  callers. stat_store was flagged and likewise left in place.

• Indirect invocation checked. The repository's only non-literal invoke()
  call sites are useEmbeddedWebview and diagnostics/rustBridge; both receive
  command names as constants, so no command is reachable through a constructed
  string. No removed command appears in src-tauri/capabilities/default.json.

• Two intermittent failures surfaced, neither caused by this PR. Both are
  races on process-global state in tests this diff does not touch, and both were
  reproduced deterministically and fixed in their own PRs:

  • database::db::connection::tests::pooled_connection_is_reused_after_drop —
    the one that failed this PR's first CI run. reset_connection_pool() clears
    the global idle pool for every path, so a parallel test can discard the
    connection this one asserts on. This PR changes no file in
    crates/database. Fixed in fix(database): serialize the tests that race on the global pool #1180.
  • agent_core::…::resolved_workspace_falls_back_to_personal_workspace — reads
    global ORGII_HOME twice and compares, without holding
    test_env::lock_home(). This PR changes no file in
    crates/agent-core/src/core/definitions/. Fixed in fix(agent-core): lock ORGII_HOME while the workspace test reads it #1181.

  Merging fix(database): serialize the tests that race on the global pool #1180 and fix(agent-core): lock ORGII_HOME while the workspace test reads it #1181 first will make this PR's CI green. Neither fix is
  folded in here: they are separate problems in separate crates.

• Not run: no TypeScript changes, so pnpm typecheck / vitest / Playwright
  were not run. No UI change, so no screenshots.

• Pre-commit hook trailer is absent. Committed from a git worktree, where
  .husky/_/husky.sh is gitignored and therefore never created by
  git worktree add, and node_modules is not installed. The hook's
  "Pre-commit hook ran." tamper-evidence trailer is structurally always missing
  in a worktree and carries no signal here. The check it would have run for a
  Rust diff is cargo clippy, which was run manually and is reported above.