refactor(tui): remove 16 dead modules, the MCP loaders and the folder-trust gate (plan D.8, decision 10) - #62

Plan D.8. The call-graph tool lists seven units of pi-shell as dead: auth::flow, config::reloader,
session::events, session::telemetry, session::unified_list, upload and upload::turn (1,008 lines).
Five of them hold only tests: auth::flow, config::reloader, upload, upload::turn and
session::telemetry. The tests of session::telemetry are a drift guard between the telemetry enums
and the permission reasons, and no code emits these telemetry events. session::events holds the
reason strings of goal and laziness events that nothing sends. session::unified_list builds the
_meta of a session/list row that nothing builds.

- Delete the files and their `mod` lines.
- Cargo.toml: remove pi-session-events. Only session::events named it. Cargo.lock follows.
- pi-workspace, permission/manager/reasons.rs: two comments no longer say that a telemetry enum
  asserts coverage against `ALL`. The test that did is gone.

pi-session-events still names these reason strings in the docs of its events, and
pi-telemetry/events/permission_analytics.rs still names the drift test. Both are candidates for
the next cleanup.

… pi-mcp, pi-agent)

Plan D.8. The call-graph tool lists these units as dead, and no file under tui/crates names them:

- pi-workspace, publish (462 lines): the merge-or-fail publish flow of the old app deployer.
- pi-tools, implementations::editor_infra (276 lines): a file-operation lock.
- pi-mcp, wire (39 lines): the x.ai/mcp/* ACP method strings.
- pi-agent, prompt::browser_verification (24 lines): a rule text. The prompt template keeps its own
  <browser_verification> block, and the flag include_browser_verification stays.

pi-tools types::error is on the same list, but it stays: it holds the From impls for ToolError that
the `?` operator needs.

…dirs (plan decision 10)

load_mcp_servers has had no caller since zypi stopped handing MCP servers to the agent (plan 1.P4).
It was the only user of the chain below it, so the chain goes with it, in pi-shell
util/config/mcp.rs:

- load_mcp_servers and reload_mcp_servers_merged.
- The loaders for mcp_preferences.json, .mcp.json, ~/.claude.json and ~/.cursor/mcp.json, and their
  helpers (McpPreferencesLoad, mcp_config_from_json_value, claude_json_mcp_from_value,
  read_mcp_json). The re-export of find_mcp_json_files goes too; the function stays in pi-workspace.
- Seven tests. Four of them built the merge of the old loader by hand ("project overrides global")
  and tested nothing else. Two read a file with read_mcp_json. One checked the JSON map of the
  loader.

parse_mcp_servers_from_toml stays: Config still reads [mcp_servers] through it (agent/config.rs),
and so do its tests.

pi-pager recent_dirs.rs had one doc comment and nothing else. Its `mod` line goes too.

The pager test session_new_and_load_send_no_mcp_servers called load_mcp_servers to show that its
fixture is something the old code found. That premise check goes. The test still checks that
session/new and session/load carry no servers, and a comment says what the fixture is.

…s that nothing calls

Both sat in util/config/mcp.rs, and no file outside that file names them (a search of tui/crates,
whole words):

- load_cli_plugin_registry. Its doc says that the pager's /agents modal uses it. The pager does not.
- The session-registry helpers: session_registry_from_toml_opt, session_registry_from_env_opt,
  session_registry_local_override_sourced, RegistrySource and SESSION_REGISTRY_ENV_VAR.
- Their two tests.

This is not on the list of plan decision 10. The next commit builds on it: it removes the code
that load_cli_plugin_registry was the last to call.

The commits before this one left more dead code behind. `cargo check` found it: 15 warnings, and
the ceiling of the baseline is 0.

- `agent::folder_trust`: the consume side of the folder-trust gate (the cache of verdicts,
  `project_scope_allowed`, `resolve_and_record` and their helpers) and its 19 tests. The loaders
  of MCP servers, plugins and permission policy were the only callers. `grant_folder_trust` stays,
  because the pager calls it. The decision side stays in `pi-workspace`, for the pager's dialog.
- `config::resolve_effective_plugins_config` (the last callers went with the plugin-registry
  helpers), `PluginsConfig::merge_claude_enabled_plugins`, `PluginsConfig::to_discovery_config`
  and the module `claude_import` (7 tests). `PluginsConfig` stays as a section of the config.
- The 3 tests of `resolve_effective_plugins_config` in `config/tests.rs`. The test
  `project_config_never_sources_feedback_user` stays: it guards live code. It now checks with
  `find_project_configs` that the project config is found.
- The re-export `util::config::McpConfig`: two tests use the type, and they import it from
  `pi-config-types` now.
- The dependency `dirs` of `pi-shell`. Its only use was `merge_claude_enabled_plugins`.
- Two doc comments in `pi-workspace`, and one line in the README of `pi-shell`, that named the
  removed code.

Tests of `pi-shell`: 838 - 54 = 784 (with the commits before this one).

- Residue ceilings: `leader` 243 to 239, `x.ai` 297 to 282. The gate asks for it, and the manifest
  says to lower a ceiling in the commit that removes lines.
- Tests of `pi-shell`: reference 838 to 784, floor 820 to 766 (the same distance, 18). 54 tests
  went with the code that they tested; none was added. The comment in the manifest has the
  count for each part.
- The dependency graph stays at 970 packages (measured): the other crates still use what the
  removed code used.

- CHANGELOG.md: an entry under Removed for the commits above. It says what went, what stays on
  purpose (`grant_folder_trust`, `pi-tools::types::error`), and the numbers.
- docs/baselines/tui-support.md: generated again with `python scripts/tui_callgraph.py keep`
  (it names commit ebc6106). The support crates have one dead unit left, `pi-tools::types::error`.
  It stays: it holds the `From` impls for `ToolError`, which code uses without a name.