refactor(rca): drop two manifest dependencies nothing in the crate uses

[emrecdr]

Implements the surviving half of cycle 18's finding F (validated in #285).

What was removed

codelore-rca declared serde_json and rayon and references neither — residue from upstream rust-code-analysis, which used them for JSON output and parallel walking. The vendored subset that survives here does neither.

Nothing about the build changes. Both remain in the graph as direct dependencies of codelore-lib (and serde_json of codelore-cli too), so this is manifest hygiene, not a supply-chain or compile-time reduction. The value is that a vendored crate's manifest should describe what the vendored code actually needs.

What was deliberately kept, and why it matters

num-traits was in the same candidate list. It is required and only looks unused.

Six generated language_*.rs files derive FromPrimitive, and num-derive's macros expand to bare num_traits:: paths that must resolve in this crate's own extern prelude. The crate does not use the #[num_traits = "…"] helper that would let a transitive copy serve. Removing the declaration fails:

error[E0463]: can't find crate for `num_traits`
 --> crates/codelore-rca/src/languages/language_java.rs:5:39
  |
5 | #[derive(Clone, Debug, PartialEq, Eq, FromPrimitive)]
  |                                       ^^^^^^^^^^^^^ can't find crate

This is why the two removals were confirmed by building without them, not by searching for them. "Absent from the source text" and "safe to remove" are different predicates — a text-based unused-dependency scanner reports the first while implying the second, and this crate is a live counter-example.

It also qualifies the cargo-machete recommendation in cycle 18: such a step is still worth wiring, but must list num-traits in package.metadata.cargo-machete.ignored and be read as a candidate list. A gate that is wrong about this crate on day one — and whose wrongness compiles cleanly until someone acts on it — would automate the exact failure these cycles keep catching.

Verification

Gate	Result
cargo fmt --all --check	clean
cargo clippy --workspace --all-targets --all-features -- -D warnings	clean
cargo test --workspace --all-features	1,746 passed, 0 failed

Same test count as before the change, so nothing was lost with the declarations. Lockfile drops 2 lines; no version resolutions move.