chore(fallow): make the whole-codebase gate pass without hiding signal

pnpm fallow failed on 14 dead-code issues, 200 clone groups (4.3% >
3.0% threshold) and one cognitive-complexity breach. Changes:
- duplicates.ignore covers convention-mandated boilerplate only (test
  files, stories, fixtures/factories/seeds, binders, symbols, feature
  manifests, vitest configs, mock/repo twins, sentry init twins,
  compliance emitters, rule-meta boilerplate) at threshold 3.0
- usedClassMembers: validateSession (interface-implemented, not yet
  called); ignoreExports: Next's generateMetadata convention export +
  the __getInstrumentationForTests test knob
- duplicate-exports off: client/server RSC twins export the same
  component name by design
- @trpc/client + @trpc/react-query added to ignoreDependencies (peer
  resolution for feature ./ui hooks); *.test.mjs marked dynamically
  loaded (node:test files fallow saw as unreachable)
- delete packages/auth/src/ui/query.ts (empty export{} placeholder
  shadowed by ui/index.ts, genuinely dead)
- extract checkDepTrace/decisionError from checkLibraryDecisions
  (cognitive 32 > 30) — behavior unchanged, tests pass

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/library-decisions/check.mjs

@@ -294,6 +294,63 @@ export function checkRenovatePr(
  *
  * An empty array means the commit is clean.
  */
+/** Parse a trace's frontmatter; error entry when decision !== approved. */
+function decisionError(content, relPath, dep) {
+  const fm = parseFrontmatter(content);
+  if (fm.decision !== "approved") {
+    return {
+      pkgJson: relPath,
+      dep,
+      reason: "not-approved",
+      decision: fm.decision,
+    };
+  }
+  return null;
+}
+
+/**
+ * Validate one new runtime dep against its staged or committed trace.
+ * Returns an error entry, or null when an approved trace covers the dep.
+ */
+function checkDepTrace(dep, relPath, staged, repoRoot, stagedAgainst) {
+  const stagedTrace = findStagedTrace(dep, staged);
+  if (!stagedTrace) {
+    // Fall back to an already-committed trace — if one exists and is
+    // approved, the dep was previously evaluated and doesn't need
+    // re-staging just because a new package adopts it.
+    const committedTrace = findExistingTrace(dep, repoRoot);
+    if (!committedTrace) {
+      return { pkgJson: relPath, dep, reason: "no-trace" };
+    }
+    try {
+      const content = fs.readFileSync(committedTrace, "utf8");
+      return decisionError(content, relPath, dep);
+    } catch (e) {
+      return {
+        pkgJson: relPath,
+        dep,
+        reason: "parse-error",
+        detail: String(e.message),
+      };
+    }
+  }
+  try {
+    const traceRef = stagedAgainst ? `HEAD:${stagedTrace}` : `:${stagedTrace}`;
+    const content = execSync(`git show "${traceRef}"`, {
+      cwd: repoRoot,
+      encoding: "utf8",
+    });
+    return decisionError(content, relPath, dep);
+  } catch (e) {
+    return {
+      pkgJson: relPath,
+      dep,
+      reason: "parse-error",
+      detail: String(e.message),
+    };
+  }
+}
+
 export function checkLibraryDecisions(
   repoRoot = DEFAULT_REPO_ROOT,
   { stagedAgainst } = {},
@@ -309,62 +366,14 @@ export function checkLibraryDecisions(
     if (tier === "app" || tier === "skip") continue;
 
     for (const dep of getNewRuntimeDeps(relPath, repoRoot, stagedAgainst)) {
-      const stagedTrace = findStagedTrace(dep, staged);
-      if (!stagedTrace) {
-        // Fall back to an already-committed trace — if one exists and is
-        // approved, the dep was previously evaluated and doesn't need
-        // re-staging just because a new package adopts it.
-        const committedTrace = findExistingTrace(dep, repoRoot);
-        if (committedTrace) {
-          try {
-            const content = fs.readFileSync(committedTrace, "utf8");
-            const fm = parseFrontmatter(content);
-            if (fm.decision !== "approved") {
-              errors.push({
-                pkgJson: relPath,
-                dep,
-                reason: "not-approved",
-                decision: fm.decision,
-              });
-            }
-          } catch (e) {
-            errors.push({
-              pkgJson: relPath,
-              dep,
-              reason: "parse-error",
-              detail: String(e.message),
-            });
-          }
-          continue;
-        }
-        errors.push({ pkgJson: relPath, dep, reason: "no-trace" });
-        continue;
-      }
-      try {
-        const traceRef = stagedAgainst
-          ? `HEAD:${stagedTrace}`
-          : `:${stagedTrace}`;
-        const content = execSync(`git show "${traceRef}"`, {
-          cwd: repoRoot,
-          encoding: "utf8",
-        });
-        const fm = parseFrontmatter(content);
-        if (fm.decision !== "approved") {
-          errors.push({
-            pkgJson: relPath,
-            dep,
-            reason: "not-approved",
-            decision: fm.decision,
-          });
-        }
-      } catch (e) {
-        errors.push({
-          pkgJson: relPath,
-          dep,
-          reason: "parse-error",
-          detail: String(e.message),
-        });
-      }
+      const error = checkDepTrace(
+        dep,
+        relPath,
+        staged,
+        repoRoot,
+        stagedAgainst,
+      );
+      if (error) errors.push(error);
     }
   }