feat(config): name the declarations that will never do anything

[RatulMaharaj]

Stacked on #184. Fourth in the series; base moves down as each merges.

Refs #174, which #184 closes. This is the other half of that issue's lesson and small enough to review separately.

Why

The most transferable finding in the whole research, from three projects hitting it three ways:

• The Claude Agent SDK ships CanUseToolShadowedWarning because a permission callback can be configured, correct, and never consulted.
• langgraph warns that severing a delta chain makes later state "silently reconstruct as empty (no error raised)".
• letta compares a persisted file's version against the running one and, on mismatch, calls print.

A control that fails by being quietly ignored is worse than one that fails loudly, because nothing surfaces and the operator's mental model stays wrong. Every declaration either takes effect or says out loud that it did not.

What it checks

inertDeclarations(config), reported at startup and by the CLI next to the existing run-grant advisories.

A credential for a host the agent cannot reach. http.auth with url: https://api.stripe.com and api.stripe.com absent from permissions.net. The request is denied before the credential is reached, so the credential does nothing. The schema documents the requirement; nothing checked it.

A permissions.net entry that is not a bare host. Entries are compared against a hostname, so https://api.github.com matches nothing and denies everything. Same for a path, a port, or userinfo. The advice names the host to use instead. This one is a plain footgun: it reads as more precise than api.github.com and is strictly worse.

memory.compact_at_tokens without memory.scope: thread. The schema's own docstring says "without scope: thread there is no history, so the threshold is inert" - documented and undetected. compact_at_tokens: false is an author declining the feature, not a mistake, so it is not flagged.

limits.max_cost with no known price. Moved here from the ad-hoc warning I added in #183, so there is one mechanism rather than two.

Not a refusal

None of these fail a config, which is a deliberate difference from the floor in #184. A floor violation is an operator's policy being breached; an inert declaration is harmless in itself, and it is the author's belief about it that costs something. Printing it fixes that.

Every line names the location (http.auth[0].url) and the fix, and there is a test asserting the advice text actually contains one.

Testing

491 pass, deno task ok clean. Eight new: a clean config producing nothing; the unreachable credential; wildcard net covering a credential host, and the apex case not covering it; each malformed net shape, with bare hosts, * and a bracketed IPv6 literal all accepted; the advice naming the right replacement host; compaction with and without thread scope and the explicit false; the spend cap fixed by either model.pricing or max_cost: 0; and a check that every declaration carries a location and an actionable fix.

What I left out

Candidates I considered and rejected, in case you want them later:

• env: entries never referenced elsewhere in the file. Too many false positives: subprocesses and MCP servers read the environment without the file mentioning the name.
• permissions.read/write paths that do not exist on disk. A path can be legitimately created later, and the check would fire in CI for every agent.
• skills: entries that no purpose text plausibly triggers. Not decidable without the model.