refactor: nuke dead exports, dead files, dead DB column, dead zero-value wrappers

Full-codebase ts-prune + manual audit sweep. Every change below is a pure
deletion (or a 2-line re-wire where a dead function was supposed to be
alive). No scope additions.

Dead wrappers / phantom features
  - shouldAutoApproveApproval: zero-value wrapper over shouldAutoApprove.
    Four call sites now import shouldAutoApprove from execution-policy
    directly.
  - evaluateRotation(session, connectorId, thresholdsOverride): the
    connectorId arg was never read (underscored), and thresholdsOverride
    was only exercised by the test suite — no production caller. Signature
    collapses to evaluateRotation(session). DEFAULT_THRESHOLDS /
    RotationThresholds exports and their tests go with it.
  - installLogRedactor: defensive console wrapper that was never wired
    from worker-entry. buildRedactor handles the known threat (env-value
    leaks); the pattern-based redactTokens stays for tests and future
    composition.

Dead files
  - resume-interrupted-tasks.ts: helper function never imported.
  - service-graph-orchestration-deps.ts: three factory closures
    superseded by the inline closures in create-orchestration-service.

Dead exports
  - listConnectorsByAuthKind (shared/connector-catalog)
  - getLocalePromptInstruction + whole localization.ts file
  - ImportantDocType
  - main-side ConnectorAuthKind (duplicated the shared one; not referenced)
  - CheckpointEngineService, RunHousekeepingService types
  - WorkspaceResolution type
  - cmdOrCtrlSymbol
  - AgentEventPush, CredentialPayload type aliases
  - parseApprovalPayloadJson, parseEnvValue, ProviderCard
  - getSOP — buildSOPSection reads the SOPS map directly; the individual
    getter had no callers. Deduped to a flat array.
  - renderWakeReason in wake-reasons/en.ts: byte-for-byte duplicate of the
    one in wake-reasons/index.ts.

Forgotten wiring (not cleanup, but adjacent)
  - registerAgentStandupRoute: the GET /api/agents/me/standup endpoint is
    advertised in every system prompt and wake-reason doc, but the route
    handler was never registered in api-server/index.ts. Agents have been
    hitting 404 since Pi Mono. Registered.

Dead DB column
  - v44 migration drops runs.context_snapshot_json. Column was added by
    v16-v25, never written or read, and v43's deliberate preservation
    was an interim measure. Same idempotent table-rebuild pattern as
    v41/v43.

Test tree
  - Phantom-feature threshold override tests removed (3). The rest of
    the rotation suite re-expressed against the real maxRuns=20 floor.

495/495 unit tests pass. typecheck + build clean.

src/main/worker/handlers/run-finished-helpers.ts

@@ -116,7 +116,7 @@ export function accumulateAndRotateSession(
     event.outputTokens ?? 0,
     event.runId,
   );
-  const rotationResult = sessionService.evaluateRotation(session, run.connectorId);
+  const rotationResult = sessionService.evaluateRotation(session);
   if (rotationResult.shouldRotate) {
     // Re-read to get updated counts after accumulation.
     const updatedSession = db.getSessionById(agentRecord.sessionId);

src/main/worker/log-redactor.ts

@@ -1,13 +1,9 @@
 /**
- * Defensive token redactor for worker process logs.
+ * Pattern-based token redactor.
  *
- * Pi-mono's HTTP clients are not known to log credentials, but stack traces
- * from upstream libraries (or future pi versions) could include header
- * fragments containing `Authorization: Bearer ...` or `?access_token=...`.
- * To prevent any such fragment from reaching the parent's stderr stream,
- * `installLogRedactor()` wraps `console.error`, `console.warn`, `console.log`,
- * `process.stdout.write`, and `process.stderr.write` so that every string
- * argument is filtered through `redactTokens()` before transmission.
+ * Complements `buildRedactor` (env-value redaction) by scrubbing common
+ * credential shapes out of arbitrary strings before they reach the parent
+ * process — Bearer tokens, provider API keys, OAuth query params.
  */
 
 const PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [
@@ -29,53 +25,3 @@ export function redactTokens(text: string): string {
   }
   return result;
 }
-
-function redactArg(arg: unknown): unknown {
-  if (typeof arg === "string") return redactTokens(arg);
-  if (arg instanceof Error) {
-    const redacted = new Error(redactTokens(arg.message));
-    redacted.name = arg.name;
-    if (arg.stack) redacted.stack = redactTokens(arg.stack);
-    return redacted;
-  }
-  return arg;
-}
-
-interface InstallTarget {
-  console: { log: typeof console.log; warn: typeof console.warn; error: typeof console.error; info: typeof console.info };
-  stdoutWrite: typeof process.stdout.write;
-  stderrWrite: typeof process.stderr.write;
-}
-
-export function installLogRedactor(target?: Partial<InstallTarget>): () => void {
-  const cons = target?.console ?? console;
-  const origLog = cons.log.bind(cons);
-  const origWarn = cons.warn.bind(cons);
-  const origError = cons.error.bind(cons);
-  const origInfo = cons.info.bind(cons);
-
-  cons.log = (...args: unknown[]) => origLog(...args.map(redactArg));
-  cons.warn = (...args: unknown[]) => origWarn(...args.map(redactArg));
-  cons.error = (...args: unknown[]) => origError(...args.map(redactArg));
-  cons.info = (...args: unknown[]) => origInfo(...args.map(redactArg));
-
-  const stdoutWriteOrig = (target?.stdoutWrite ?? process.stdout.write).bind(process.stdout);
-  const stderrWriteOrig = (target?.stderrWrite ?? process.stderr.write).bind(process.stderr);
-  process.stdout.write = ((chunk: unknown, ...rest: unknown[]) => {
-    if (typeof chunk === "string") return stdoutWriteOrig(redactTokens(chunk), ...rest as never[]);
-    return stdoutWriteOrig(chunk as never, ...rest as never[]);
-  }) as typeof process.stdout.write;
-  process.stderr.write = ((chunk: unknown, ...rest: unknown[]) => {
-    if (typeof chunk === "string") return stderrWriteOrig(redactTokens(chunk), ...rest as never[]);
-    return stderrWriteOrig(chunk as never, ...rest as never[]);
-  }) as typeof process.stderr.write;
-
-  return () => {
-    cons.log = origLog;
-    cons.warn = origWarn;
-    cons.error = origError;
-    cons.info = origInfo;
-    process.stdout.write = stdoutWriteOrig;
-    process.stderr.write = stderrWriteOrig;
-  };
-}