chore(workspace): gate dead-code with knip production mode

Turn on production-mode knip plus an autofix run in pre-commit and the
`pnpm dead-code` script, document the `/** @internal */` convention for
test-only exports in AGENTS.md, annotate test-only exports across the
CLI with that JSDoc, and drop dead exports/wrappers the new gate
surfaced (e.g. `cli-project.ts`, `lookerRuntimeSourceToFileAdapterSource`,
`createLocalScanEnrichmentProvidersFromConfig`,
`PGLITE_OWNER_PROCESS_BACKEND_CAPABILITIES`, stale type re-exports).
Replace the loose `ignoreIssues` allowlist in `knip.json` with explicit
production entries so cross-package barrel leaks are caught.

.pre-commit-config.yaml

@@ -41,8 +41,13 @@ repos:
         language: system
         pass_filenames: false
       - id: knip-dead-code
-        name: knip dead-code check
-        entry: pnpm exec knip --reporter compact
+        name: knip dead-code (auto-fix)
+        entry: pnpm exec knip --fix --reporter compact
+        language: system
+        pass_filenames: false
+      - id: knip-dead-code-production
+        name: knip dead-code (production mode)
+        entry: pnpm exec knip --production --reporter compact
         language: system
         pass_filenames: false