refactor: nuke dead exports, dead files, dead DB column, dead zero-value wrappers

Full-codebase ts-prune + manual audit sweep. Every change below is a pure
deletion (or a 2-line re-wire where a dead function was supposed to be
alive). No scope additions.

Dead wrappers / phantom features
  - shouldAutoApproveApproval: zero-value wrapper over shouldAutoApprove.
    Four call sites now import shouldAutoApprove from execution-policy
    directly.
  - evaluateRotation(session, connectorId, thresholdsOverride): the
    connectorId arg was never read (underscored), and thresholdsOverride
    was only exercised by the test suite — no production caller. Signature
    collapses to evaluateRotation(session). DEFAULT_THRESHOLDS /
    RotationThresholds exports and their tests go with it.
  - installLogRedactor: defensive console wrapper that was never wired
    from worker-entry. buildRedactor handles the known threat (env-value
    leaks); the pattern-based redactTokens stays for tests and future
    composition.

Dead files
  - resume-interrupted-tasks.ts: helper function never imported.
  - service-graph-orchestration-deps.ts: three factory closures
    superseded by the inline closures in create-orchestration-service.

Dead exports
  - listConnectorsByAuthKind (shared/connector-catalog)
  - getLocalePromptInstruction + whole localization.ts file
  - ImportantDocType
  - main-side ConnectorAuthKind (duplicated the shared one; not referenced)
  - CheckpointEngineService, RunHousekeepingService types
  - WorkspaceResolution type
  - cmdOrCtrlSymbol
  - AgentEventPush, CredentialPayload type aliases
  - parseApprovalPayloadJson, parseEnvValue, ProviderCard
  - getSOP — buildSOPSection reads the SOPS map directly; the individual
    getter had no callers. Deduped to a flat array.
  - renderWakeReason in wake-reasons/en.ts: byte-for-byte duplicate of the
    one in wake-reasons/index.ts.

Forgotten wiring (not cleanup, but adjacent)
  - registerAgentStandupRoute: the GET /api/agents/me/standup endpoint is
    advertised in every system prompt and wake-reason doc, but the route
    handler was never registered in api-server/index.ts. Agents have been
    hitting 404 since Pi Mono. Registered.

Dead DB column
  - v44 migration drops runs.context_snapshot_json. Column was added by
    v16-v25, never written or read, and v43's deliberate preservation
    was an interim measure. Same idempotent table-rebuild pattern as
    v41/v43.

Test tree
  - Phantom-feature threshold override tests removed (3). The rest of
    the rotation suite re-expressed against the real maxRuns=20 floor.

495/495 unit tests pass. typecheck + build clean.

src/main/api-server/index.ts

@@ -1,6 +1,7 @@
 import { AgentApiServer, type ApiServerEventCallbacks } from "./server-core";
 import { registerAgentRoutes } from "./routes-agents";
 import { registerAgentControlRoutes } from "./routes-agent-control";
+import { registerAgentStandupRoute } from "./routes-agents-standup";
 import { registerTaskRoutes } from "./routes-tasks";
 import { registerWorkGraphRoutes } from "./routes-work-graph";
 import { registerMessageRoutes } from "./routes-messages";
@@ -28,6 +29,7 @@ export function createApiServer(
   const server = new AgentApiServer(db, onDomainChanged, onWakeAgent, callbacks, allowedOrigins);
   registerAgentRoutes(server);
   registerAgentControlRoutes(server);
+  registerAgentStandupRoute(server);
   registerTaskRoutes(server);
   registerWorkGraphRoutes(server);
   registerMessageRoutes(server);

src/main/api-server/routes-agents.ts

@@ -8,7 +8,8 @@ import {
   getHireRoutingValidationError,
   resolveHireReportsTo,
 } from "../agent-permissions";
-import { resolveApprovalDecision, shouldAutoApproveApproval } from "../approval-policy";
+import { resolveApprovalDecision } from "../approval-policy";
+import { shouldAutoApprove } from "../execution-policy";
 import { requireParam, type AgentApiServer } from "./server-core";
 
 export function registerAgentRoutes(server: AgentApiServer) {
@@ -365,7 +366,7 @@ export function registerAgentRoutes(server: AgentApiServer) {
     });
 
     let autoApproved = false;
-    if (shouldAutoApproveApproval(db, companyId, "hire_agent")) {
+    if (shouldAutoApprove(db, companyId, "hire_agent")) {
       resolveApprovalDecision({
         db,
         handleApprovalResolved: callbacks.onApprovalResolved,

src/main/api-server/routes-approvals.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import log from "electron-log/main.js";
 import { approvalInputSchema } from "@shared/contracts";
-import { resolveApprovalDecision, shouldAutoApproveApproval } from "../approval-policy";
+import { resolveApprovalDecision } from "../approval-policy";
+import { shouldAutoApprove } from "../execution-policy";
 import { requireParam, type AgentApiServer } from "./server-core";
 
 const approvalListQuerySchema = z.object({
@@ -69,7 +70,7 @@ export function registerApprovalRoutes(server: AgentApiServer) {
     // Notify thread integration about the new approval
     callbacks.onApprovalCreated(id, companyId, input.relatedTaskId ?? null, input.type, input.payloadSummary ?? "");
 
-    if (shouldAutoApproveApproval(db, companyId, input.type)) {
+    if (shouldAutoApprove(db, companyId, input.type)) {
       resolveApprovalDecision({
         db,
         handleApprovalResolved: callbacks.onApprovalResolved,