feat(compiler): DEP003/DEP004 — warn when reads/writes labels are over-declared (?bs 0.9+)

[marcelofarias]

Closes #99.

Summary

• DEP003: fires when a fn has same-file callees but none (transitively) declare reads { x } that the fn also declares — annotation likely became stale after a refactor removed the callee that originally justified it
• DEP004: symmetric check for writes { ... }
• Both are warning-level (non-blocking). Leaf fns (no tracked callees) are excluded — they may be the actual resource access point
• Adds DEP003/DEP004 entries to error-codes registry and the MCP explain tool

Test plan

• pnpm test — 738 tests pass (31 test files)
• DEP003 fires for a fn that calls a non-declaring helper but declares a reads label
• DEP003 does NOT fire when label is justified by a same-file callee (direct or transitive)
• DEP004 mirrors DEP003 for writes labels
• Neither fires below ?bs 0.9
• Neither fires for leaf fns
• MCP explain DEP003 / explain DEP004 return correct entries with valid fails/passes examples

🤖 Generated with Claude Code