chore: drop an unused dirs declaration, reject the cargo-machete gate

[emrecdr]

Cycle 18 recommended wiring cargo-machete to automate the unused-declared-dependency class. Running it first disqualified it — and turned up one real finding, which this PR fixes.

The measurement

cargo machete reports six findings on this workspace. One is real.

Reported	Verdict
dirs (cli)	✅ True positive — removed here
num-traits (rca)	❌ required via #[derive(FromPrimitive)] expansion; removing it fails with E0463
tree-sitter-java	❌ named inside mk_langs! — a grammar the product dispatches
tree-sitter-javascript	❌ same
tree-sitter-python	❌ same
tree-sitter-rust	❌ same

Four of the five working grammars are reported as removable. Acting on that output deletes Java, JavaScript, Python and Rust support.

The mechanism, proved by the tool's own output

tree-sitter-typescript is the only grammar it does not flag — and the only one named outside the macro, appearing directly in the get_language! special case in macros.rs. Four grammars named only inside mk_langs!: flagged. One named outside: clean.

cargo-machete is a text scanner and macro invocations are opaque to it. cargo-shear concedes the same limit, liftable only with a nightly --expand.

This also sharpens what #278's CHANGELOG said. That entry noted unused-dependency tooling "would not have found" the unreachable grammars. The more dangerous fact is that it actively reports the working ones as removable.

Why rejected rather than deferred

"Deferred" implies waiting on something; nothing is pending. Reaching green would take five ignore entries, at which point the gate suppresses more than it reports and each entry is a standing invitation to remove the wrong one.

It also fails the bar this repo set when adopting zizmor: an advisory version was written and discarded because "a check that is red on every pull request teaches people to ignore red checks."

The class is still worth catching. The method that works is the one that found all of this: remove the declaration and build.

The real finding

codelore-cli declares dirs and never calls it. All three mentions in its sources are comments about codelore-lib's cache-root resolution; the single real dirs::cache_dir() lives in codelore-lib/src/cache.rs:133 beside that crate's own declaration.

Verified by deleting the declaration and building — which matters here, because the name does appear in the crate's text. A grep says "used"; the build says otherwise. That is the mirror image of num-traits, which appears zero times and is required.

Placement

Recorded as a struck-through Tier 2 row, not under "Deliberately out of scope" — that section is for product-scope exclusions surfaced from competitive and literature audits, and this is a tooling evaluation. It matches the closed petgraph row directly beneath it.

Verification

• cargo fmt --all --check — clean
• cargo check -p codelore --all-targets --all-features — clean with the declaration removed
• The full workspace gate could not complete locally: libduckdb-sys hit ENOSPC (errno 28) on a host at 100% disk (92G shared cargo cache). CI carries that verification.