chore(platform): remove rg-proven dead code from the 0.5 backend

[larryro]

Dead-code cleanup, every removal rg-proven (zero callers) and tsc-proven (nothing referenced it). Stays out of the Convex-retirement residue (#3125: init-scripts/02-create-convex-database.sql, compose comments, the tale_platform volume, the remaining env.sh comments) and out of the resolveUserEnvForInjection / feature-flag plumbing (product decision pending).

Why knip never flagged any of this: backend/**/*.ts are knip entries for services/platform, so unused exports of backend files are not reported.

Per-target outcome

1. services/platform/env.sh — removed ensure_hex_instance_secret and its Convex generate-admin-key comment. rg: only its definition; ensure_instance_secret is the one wired (docker-entrypoint.sh:222). bash -n clean.
2. core/tasks/review_shared.ts — trimmed to REVIEW_POLICY_REFUSAL_CODES (sole importer domains/tasks/service.ts:17, still there). Every other export (approvalRound, approvalRunId, resolveReviewer, TaskReviewTrigger, requestTaskReview, TaskReviewResponse, isReviewPolicyRefusal, checkReviewPolicyForResponder, collectTaskWatcherIds, TaskReviewLeaveActor, closePendingTaskReviewOnStatusLeave) had zero importers; the live gate is domains/tasks/reviews.ts. core/collab/notify_task_reviews.ts — removed: its only importer was review_shared.ts; notifyTaskReviewRequested/notifyTaskReviewResolved/TaskReviewSubmitter live in domains/collab/service.ts, notifyTaskReviewerAssigned had no caller anywhere.
3. core/automations/store.ts — removed. One importer in the tree: core/provisioning/provision_default_automations.test.ts, pulling assertAutomationName. Repointed to domains/automations/store.ts (the store that runs; same export, a superset name rule) — the test's assertion "a name the store would refuse must never ship" now checks the real store. 2/2 green.
4. Harness signUpOrgMember convergence — not done. The shared helper does not exist on main; it is introduced by draft PR test(platform): make a truncated itest run fail loudly #3198 (fix/itest-harness-integrity), which also rewrites several of the 21 raw sign-up/email sites. Forking the helper here would conflict with that PR — converge after test(platform): make a truncated itest run fail loudly #3198 lands.
5. format:check vs the edit hook — no change; the premise does not hold. oxfmt honors .oxfmtrc.json ignorePatterns (**/*.md, **/*.yml) for explicitly passed paths too: bunx oxfmt -c .oxfmtrc.json docs/en/cloud/onboarding.md → "All matched files may have been excluded by ignore rules", and running the hook itself in write mode on a known-unformatted page (docs/fr/develop/rate-limits.md) changed nothing. Hook and CI agree today (both skip markdown). For the record: with **/*.md un-ignored, oxfmt --list-different names 13 of 439 docs pages and 16 other .md files (AGENTS/skills/design docs) — enabling markdown formatting is a separate reformat decision, not a dead-code PR.
6. Other named stubs. deleteKnowledgeDocumentsBatch — kept, live (domains/knowledge/release.ts:172). generateReplacementBlobUpload + ReplacementBlobUploadHandoff + CONVEX_UPLOAD_TTL_MS — removed (zero consumers; the live replacement lane domains/documents/replacement.ts presigns directly; putImmutableS3Blob kept, live at replacement.ts:562). generateBlobUpload — removed too (zero callers; the frontend's files/blob_actions:generateBlobUpload is the wire's action name, served by domains/files/routes.ts /blob-upload, not this function). Unused imports DEFAULT_PRESIGN_TTL_SEC/s3PresignPutUrl pruned with them.

One-hop orphans removed (each had exactly one importer — a file removed above — and a live pg twin): core/collab/dismiss_review_notifications.ts, core/notifications/actor_name.ts (incl. the never-called resolveActorAndSubject), core/governance/competence.ts, core/governance/review_policy.ts, core/audit_logs/agent_run_ledger.ts (twin domains/tasks/run-ledger.ts).

Left alone / follow-ups: core/betterAuth/trusted_headers/get_user_by_id.ts is now import-free (second hop — its only importer was actor_name.ts); prose mentions of the 0.4 automationActionStore in dispatch-store.ts:40 / run_session.ts:9; the convex/collab/notify_task_reviews.ts path in lib/i18n/keys-dynamic.yml:99 (Convex residue → #3125).

Gates run and observed

• bash -n services/platform/env.sh — OK
• services/platform: bunx tsc --noEmit — exit 0 (50 s)
• services/platform: bunx oxlint --type-aware — exit 0
• vitest (server project) touched suites — 7 files, 67 tests passed (provision_default_automations, bound_run_payload, session_exec, collab/service, automations/store.*, governance/helpers)
• root bunx oxfmt --check — 4470 files, all formatted
• root bunx knip — exit 0 (one pre-existing hint: cron-parser in ignoreDependencies)
• backend:integration — not run: the harness is untouched (target 4 not done) and every removed symbol had zero callers, which the typecheck proves.