chore(policy): shadow-run strict severity policy (cycles/dead-code as error) and publish the counts

[EivMeyer]

Goal

Decide the strict severity policy (cycles as error, dead code as error) from measured findings instead of opinion. This issue closes with numbers attached, not code.

Method

Run the candidate strict policy in report-only mode against:

1. this repo (opcore checking opcore), and
2. at least one large local production repo (1M+ LoC scale, agent-written code preferred — the population the gate exists for).

No target repo is modified; the run is a local opcore check against a checkout, and the counts get pasted here.

Collect, per check (typescript.import-graph cycles, typescript.dead-code, rust.import-graph, rust.dead-code):

• total findings at scope all
• findings under --report-mode introduced for a sample of recent changes
• manual classification: true positive vs false positive, with the false-positive reason (public package API, framework-loaded module, dynamic reference, other)

Example of the output this issue wants

would-block: 217 findings
  cycles:        3    all real (payment code)          -> safe to promote
  dead exports:  214
    genuinely dead helpers:                9           -> would be correctly blocked
    framework-loaded (router by filename): 182         -> false positive
    public package API (exports/main):     23          -> false positive

A result like that means: promote cycles now, hold dead-code-as-error behind entrypoint modeling.

Acceptance

• Counts and false-positive classification posted for both corpora.
• A one-paragraph recommendation per check: promote / hold / hold-behind-dependency.

Depends on

• Canonical cycle fingerprints (fix(validation): canonical cycle fingerprints so introduced-mode never re-reports pre-existing cycles #284) — without stable fingerprints the introduced-mode counts are noise.

[EivMeyer]

Update after verifying against main (v0.2.1): the #284 prerequisite is already satisfied on main (canonicalCycle() ships), so this shadow run is unblocked and can start immediately. Run it against a checkout of main, not the codex/repo-check-packs branch.