fix(scanner): stop dead-code flagging public API; deepen detection (Codex #10)

[telivity-otaip]

Summary

Codex review finding #10 — dead-code analysis too shallow. The scanner flagged any export with no in-repo references as dead. But a package's public API lives in its entry point (index.* / __init__.py) and is consumed by code outside the repo, where the usage grep is blind — so the entire public API surface was reported as removable. Acting on those findings would break downstream consumers.

Changes

• Entry-point exemption — symbols declared in barrel / package-root files are never flagged. New optional DeadCodeProfile.isEntryPoint(path); when a profile omits it, the scanner applies a convention default (index.ts|tsx|js|mjs|cjs|… and __init__.py) via the exported isEntryPointFile() helper.
• Honest uncertainty — dead-code task descriptions now state the finding is grep-based reachability (not type-aware) and to confirm the symbol isn't reflectively used or part of an external API before removing. The category stays severity: low.
• Recall fix — the TS export regex now also matches enum, abstract class, and async function declarations (previously silently missed).

Why not full type-graph analysis

True reachability needs a TS type graph (ts-morph / tsc --noUnusedLocals semantics) — a heavy dependency and slow per-scan. This keeps the detector deterministic and fast while removing its single biggest false-positive class (public API) and making the residual uncertainty explicit to whoever acts on the task.

Test plan

New scanner.test.ts cases:

• exports in a public index.ts with no in-repo uses are not flagged
• an unused export in a non-entry file is still flagged, and carries the heuristic caveat
• isEntryPointFile table (index.* and __init__.py true; indexer.ts, my_init.py, plain source false)

Local validation: asil-improvement-loop 191 tests, build + typecheck clean.