chore(workspace): gate dead-code with knip production mode

Turn on production-mode knip plus an autofix run in pre-commit and the
`pnpm dead-code` script, document the `/** @internal */` convention for
test-only exports in AGENTS.md, annotate test-only exports across the
CLI with that JSDoc, and drop dead exports/wrappers the new gate
surfaced (e.g. `cli-project.ts`, `lookerRuntimeSourceToFileAdapterSource`,
`createLocalScanEnrichmentProvidersFromConfig`,
`PGLITE_OWNER_PROCESS_BACKEND_CAPABILITIES`, stale type re-exports).
Replace the loose `ignoreIssues` allowlist in `knip.json` with explicit
production entries so cross-package barrel leaks are caught.

packages/cli/src/managed-python-http.ts

@@ -21,12 +21,13 @@ import {
 } from './managed-python-command.js';
 import { startManagedPythonDaemon, type ManagedPythonDaemonStartResult } from './managed-python-daemon.js';
 
+/** @internal */
 export type ManagedPythonHttpJsonRunner = (
   path: string,
   payload: Record<string, unknown>,
 ) => Promise<Record<string, unknown>>;
 
-export type ManagedPythonHttpPostJson = (
+type ManagedPythonHttpPostJson = (
   baseUrl: string,
   path: string,
   payload: Record<string, unknown>,
@@ -75,7 +76,7 @@ function parseJsonObject(raw: string, path: string): Record<string, unknown> {
   return parsed as Record<string, unknown>;
 }
 
-export async function postManagedDaemonJson(
+async function postManagedDaemonJson(
   baseUrl: string,
   path: string,
   payload: Record<string, unknown>,
@@ -117,6 +118,7 @@ export async function postManagedDaemonJson(
   });
 }
 
+/** @internal */
 export function createManagedPythonDaemonBaseUrlResolver(
   options: ManagedPythonCoreDaemonOptions,
 ): () => Promise<string> {
@@ -158,6 +160,7 @@ function isResolveBaseUrlOnly(
   return 'resolveBaseUrl' in options;
 }
 
+/** @internal */
 export function createManagedDaemonHttpJsonRunner(
   options: ManagedPythonDaemonHttpOptions,
 ): ManagedPythonHttpJsonRunner {