chore: cleanup pass: stale paths, unused dep/CSS/exports, audit patches, unused screenshots

[dsmcewan]

What changed

• Stale generator paths. .design-sync/scripts/gen-css.mjs, gen-dtsprops.mjs and gen-fixtures.mjs told readers to run them from .ds-sync/, the design-sync tool's ignored runtime directory. They now name .design-sync/scripts/, matching config.json's buildCmd.
• Unused devDependency. @eslint/eslintrc is imported by nothing; eslint.config.mjs uses eslint-config-next's flat config directly. It stays installed as a dependency of eslint itself.
• Dead CSS. .audioPrompt and .stopBadge in Placard.module.css had no references since AudioTourButton replaced them (44356de).
• Unused exports. COPY.siteTitle, COPY.audioGuidePrompt and getCatalog() had no readers or importers (COPY.siteTitleLines is used and kept).
• Security patches. npm audit fix without --force, lockfile only, all within existing ranges: next 15.5.19 → 15.5.26 (clears the critical advisory), vitest 3.2.6 → 3.2.7, plus postcss under vite, nanoid, js-yaml and tinyspy.
• Unused screenshots. Deleted docs/screenshots/gallery.png and gallery-wing.png (about 4 MB, referenced nowhere) and the two steps in scripts/screenshots.mjs that produced them.

Verification

The deploy workflow's steps, run locally on Node 22 / npm 10 as CI does:

npm ci              ok
npm run lint        clean
npm test            6/6 passed
npx tsc --noEmit    clean
npm run build       ok: 107/107 static pages, verify-export OK (103 exhibit pages, all image variants)

PR CI here only runs claude-review, which fails on the repository's OAuth token; see the earlier PR comment.

Left for you

1. 5 audit findings remain, each needing a major bump: next's pinned postcss@8.4.31 (fix is next 16), sharp (0.35), and vitest / @vitest/mocker (vitest 5). Production-only: 3 findings (next, its postcss, sharp).
2. scripts/assemble-designs.ts is a one-time assembly script whose inputs are not in the repo; kept for provenance.
3. npm run audio hard-codes the Windows venv path tts/.venv/Scripts/python.

Checked and clean: every one of the 103 PNGs in crossroad_imgs/ (329 MB) is used by the catalog; audio files, manifest and slugs match 103/103; no TODO/console.log; no tracked build artifacts; all doc links resolve.

🤖 Generated with Claude Code

https://claude.ai/code/session_01U142aAXSzf4pUt89HSvXTH

[dsmcewan]

CI status on c2b7d42: the only check that runs on pull requests here is claude-review (the deploy workflow with lint/test/build runs on pushes to main), and it is red.

That failure is not this PR's. The job reaches the Claude Code SDK and gets back Claude execution failed: result is_error:true within seconds of starting, with no model turn. The same workflow failed the same way on all three runs of PR #7 on 2026-08-25 (runs 6, 7 and 8), before this branch existed; the last successful run was on 2026-08-13. That is the signature of the CLAUDE_CODE_OAUTH_TOKEN repository secret being expired or unset, and dsmcewan/Convergence#40 is showing the identical failure today.

Nothing in this diff (three comment lines in .design-sync/scripts/) can affect it, and no fix exists in-repo since the token is a repository secret. Re-minting it with claude setup-token and updating the secret should restore the check. Locally on this head: npm run lint clean, npm test 6/6. I do not have permission to re-run the job from this session.

---

Generated by Claude Code