Resolve all defect-hunt findings: wire dead features, fix bugs, prune dead code

[RNT56]

Summary

A full-project defect hunt (15 scopes, adversarially verified) found 0 CRITICAL, 1 HIGH, 10 MEDIUM, 35 LOW on the post-remediation tree. All are resolved here, each with a test. An adversarial review of the assembled diff then caught 5 regressions (2 confirmed + 3 from a focused provider verifier) — all fixed. 103 files, +2949/−991 (the deletions are dead-code pruning).

Bugs fixed

• HIGH — desktop I3 secret-reflow leak: desktop sessions never scrubbed typed secrets from observations (the browser tier does). Ported typedSecrets/scrubObservation to desktopsession.
• Browser irreversible actions were dead-blocked (BrowseTool built with a nil Approver) → wired the console approver.
• Native computer-use collapsed right/double/drag/middle into one left click → extended the desktopwire.Act contract (button/count/drag/mouse up-down) + both drivers; unsupported variants fail closed.
• Desktop had no in-code irreversible gate → added a per-action classifier + Approver, symmetric with the browser, word-boundary matched (so "information"/"sender" aren't mis-gated).
• claude-code backend emitted --output-format stream-json without --verbose (current CLIs reject it) → fixed.
• importgraph path-boundary + inspect.Replay 1MB line cap → fixed.

Features wired (built + tested, never reached from production)

• External SecretStore (the 4th I3 backend) into the read chain.
• Served-model pricing — the meter prices Response.ServedModel, now resolving vendor-namespaced OpenRouter ids (anthropic/claude-opus-4-8) to their real tier instead of the floor.
• OpenRouter routing extras + response_format/tool_choice via Tuning (env-driven, I3-safe, JSON-validated); exported the previously-uncallable option types.
• Cost-aware routing (RTE-T06) — wireMultiBackend supplies a PricerCost func.
• Objective success-tracking — the autonomy handler calls MarkSuccess/MarkAttempt; LastSuccess/RetryPeriod persist (+ the migration is now called from Store.migrate — a review-caught HIGH: it broke existing DBs).
• Live code-graph deletion hook on delete/rename; egress schema_version validation; swarm ClassifyCeiling/ProjectTrusted wired; interactive trace --tui explorer.

Dead code pruned (verified zero non-test callers)

route.SingleRouter (dup), agenticflows.Node.Agent, mcp.Spawn/Manager.Servers, verify.ContentHashFiles, eventlog.Log.Flush, emit.NopEmitter, termui.Style.Magenta, report.runReport, objective.MarkRun, skills.Plugin, autosrc adapters, impact.Localize (SBFL), policy.Gate/EgressWith. Deploy auto-approval kept as an honestly-labeled roadmap seam.

Verification

make verify (119 pkgs, lint-inclusive) + tui-verify + Linux cross-build + the -race lane + a fully-uncached go test -count=1 ./... — all green.

🤖 Generated with Claude Code