Add knip configuration and CI gate for unused code detection

[IanMayo]

Summary

This PR establishes unused code scanning as a gated CI check for the monorepo by adding knip configuration, removing a genuine orphan module, and integrating knip into the CI pipeline.

Changes

• Added knip.json at repo root with entry point declarations for the Electron loader (main, preload, and renderer processes) to eliminate false positives from the scanner
• Deleted apps/loader/src/main/updater.ts — a genuinely unused module with no call sites or tests, kept as a placeholder for future auto-update work that belongs in its own spec
• Updated .github/workflows/ci.yml to add a "Run knip" step after linting, making knip a required CI gate rather than an ad-hoc diagnostic
• Added knip as a pinned dev dependency (invoked via pnpm exec knip rather than pnpm dlx) to ensure reproducible builds and prevent silent version upgrades from affecting CI results
• Added JSON Schema validation under specs/201-knip-loader-config/contracts/ to prevent future ignore entries or workspace stanzas from being added without explicit coordination
• Captured evidence (before/after transcripts and first CI run logs) for audit trail

Implementation Details

The configuration takes a principled approach to scanner hygiene:

• Refuses to use dlx for CI-critical tools — version pinning is non-negotiable once CI depends on output
• Refuses to silence true findings with ignore lists — the scanner's value is in telling the truth; masking real orphans defeats the purpose
• Centralizes config at repo root for discoverability in a monorepo context
• Covers all three Electron entry categories upfront to prevent future contributors from hitting false positive clouds

This is infrastructure and hygiene work with no user-facing changes. The audience is contributors who need to trust the scanner's output.

https://claude.ai/code/session_01G3vAESEa23shFAo3o1nuGs