refactor: remove dead code left by recent cuts

[jimhoyd]

This sweeps dead code left by #1048, #1050, #1055, #1049 and #1066. Net: 38 insertions, 43 deletions (-5 lines). It also deletes about 71 KB of orphaned generated CSS that sat on two lines.

The search found very little dead code: the earlier cuts removed their own helpers. npx knip (not added as a dependency) plus a git grep reference count over every export in packages/*/src, scripts/, test/ and packages/*/test found only one symbol with no references at all, extensionHooksSchema. It is public API: it is documented in docs/EXTENSIONS.md and belongs to the hooks contract packages/mcp uses, so it stays.

Removals

Change	Evidence
Delete packages/ui/src/kit-styles.generated.ts and styles.generated.ts (the whole remaining packages/ui/)	git grep -e kit-styles -e styles.generated -e packages/ui finds nothing. The ui extension was deleted in c5293fd (#895), and 1c70733 (#922) re-added these two generated files by accident. The directory has no package.json, so it was never a workspace.
package-files.ts: drop the limits = packageFileLimits parameter from hashPackageFiles and compareFiles; unexport packageFileLimits, hashPackageFiles and compareFiles	git grep -e 'hashPackageFiles(' -e 'compareFiles(' finds only the two definitions and two internal calls, none passing limits. The parameter was shared with readTarball/verifyPackageOnline, which #1048 removed. No importer of package-files.ts imports these three names.
Unexport values used only inside their own module (none of these modules is a package.json#exports entry, and neither the entries nor tests re-export them): auth.ts: authSeedSchema, openAuthDatabase, hermeticRateLimitFactor. addon-install.ts: sitePaths, artifactManifestKeys, artifactLockProblem, addonLoadError, isPackageSpec, independentLockProblem, localTarballProblem. addon-manifest.ts: artifactMediaTypes, MAX_ARTIFACT_DOCUMENTS, isContractVersion, isExtensionTargets, declaredPrincipalSecurity. cli-errors.ts: contextPlaceholders. extensions-cli.ts: addonCommands. openapi-check.ts: officialOpenApiSchema, openApiSchemaObjects. project-schemas.ts: projectSchemaName, projectSchemaFileLimits. project-tests.ts: readSeed. temp-dirs.ts: staleRunDirectoryMs. store collection.ts: READER_LIMITS, refuseBalance, invalidRecord, inState, refuseLocked, STORED_OUTSIDE. store store.ts: storeSeedSchema	knip listed them as unused exports. A word-boundary search of every tracked code, JSON and YAML file for each name matched only its own file. Types and every symbol exported from a public subpath were left alone.
Comments: "A hermetic run (test, audit, benchmark)" becomes "(test, audit)" in packages/{auth,store}/src/extension.ts. Removed the line in test/fixtures/addons/tarball.mjs saying the fixture is "Independent of core's own reader (package-files.ts)"	benchmark was removed in #1048, and so was core's tarball reader (readTarball).

Checked and kept

• Root devDependencies: all in use. picomatch is used by scripts/ci-changes.ts, @hey-api/openapi-ts by test/openapi.test.ts, and semver by the release scripts.
• package.json scripts: every script path exists. files entries: all exist.
• Files knip reported as unused: all are referenced. scripts/operational-drills.ts runs in ci.yml, render-homebrew.ts in release-pack, scripts/repro/* in v8-jit-repro.yml, and data/agents/index.d.ts declares index.js.
• CLI commandOptions: every flag is still read in cli.ts or extensions-cli.ts.
• Fixture names: test fixtures that name packages/audit or @jimhoyd/urlcode-audit (release-bump, package-audit and scaffold tests) use them as synthetic sibling-package names to test generic logic, so they were not changed.

Filed instead of done

• [Request]: Collapse the store's schema migrations to one baseline and drop auth's auth_servers cleanup #1078: collapse the store's eight schema migrations to one baseline and drop auth's DROP TABLE IF EXISTS auth_servers. This is upgrade code for database shapes from before One serving process per database: replace the host lease with an OS lock #1050 and feat(store): audit log in the store with a core tap; name is the role; cut ownerless (#1052 S4, #1041) #1066. Removing it changes what an existing database does when it opens, so the owner needs to decide.

Verification

• npm run typecheck: passes.
• npm run verify: exit 0. It covers lint, typecheck, tooling typecheck, check:code, check:docs, build, the root suite (1319 tests) and every workspace's verify plus the add-on, proof and ecosystem suites, all with 0 failures.
• No manifest changed, so test:package was not run.
• No generated reference changed.

🤖 Generated with Claude Code