refactor(lint): make each dead-code suppression falsifiable, and finish the crate rename

[forkwright]

Two commits, both finishing work issue 264 started. Neither closes it — the
issue's own Done when is satisfied by these, but the closing call belongs on
the issue rather than in a merge parser.

1. Suppressions that can be disproved

All 7 dead-code suppressions carried a tracking ref, which satisfied the letter
of WORKFLOW/unwired-dead-code-untracked. Each named a direction rather than
a consumer — "await daemon integration", "staged for the akroasis hardware
backend". Nothing can ever contradict a reason like that, so a suppression can
be accurate and permanent at once, which is the condition the rule exists to
surface rather than a state it should reach.

Each now names the issue whose landing makes it provably wrong:

Site	Now points at	Why that one
main.rs:11 mesh tables	83	the helpers need a live NodeDb + GatewayBridge; the CLI has neither and says so in three constants. 83 is the Meshtastic connection layer that supplies them
baofeng/constants.rs, variant.rs	79	both are hardware-serial gated and consumed only by the protocol module; 79 qualifies exactly that protocol, naming the same magic bytes and variant handling
hardware/warnings.rs ×3	410	HardwareWarning is constructed nowhere outside its own file while the detect path already runs without surfacing warnings; 410 owns the caller-initiated detect surface
main.rs:63 Config	461	not staged work at all — loaded and discarded, see below

The mapping was derived by reading each consumer, not by matching issue titles,
and every named helper was confirmed to still have zero references outside its
defining file.

2. Finishing the rename

The crate split moved the code and left every description of it behind, so the
repo documented a koinon crate that no longer exists: the README domain map
and diagram, CLAUDE.md, AGENTS.md, docs/ARCHITECTURE.md, the lexicon, both
_llm corpora, and 14 comments explaining which crate owned what.
stoicheion/tests/smoke.rs described itself as "smoke tests for the koinon
public API".

The README and lexicon carry both halves with their own etymologies rather than
one row renamed in place, because the split divided two concepts and a rename
would have hidden that.

Three were stale in ways searching for the old name would not surface:

fuzz/Cargo.lock still resolved koinon at 0.5.0. That workspace is
detached, so no main-workspace resolution reaches it; it was two releases behind
before this rename touched it. This one is not cosmetic — security.yml runs
cargo audit --file fuzz/Cargo.lock and osv-scanner reads
--lockfile=fuzz/Cargo.lock, so both scanners were auditing dependency versions
that are not the ones being built.

crates/stoicheion/.kanon-lint-ignore suppressed nothing. It exempted
RUST/pub-visibility for a gap the rule no longer has. Measured both ways: 38
bare pub items across the crate's non-lib files, and the rule reports nothing
repo-wide with the ignore removed. Deleted — a suppression that suppresses
nothing states something untrue about the code and would absorb a real
violation later.

.kanon-lint-baseline.toml still carried the two koinon collision
entries its own reason described as "deferred to a fleet naming decision" —
the decision the rename made.

storage.rs also stopped indexing to build a slice.
&public_key_bytes()[..] tripped RUST/indexing-slicing, which CI's clippy
cannot catch because indexing_slicing is an allow-by-default restriction lint;
.as_slice() says the same thing without an index expression. That line came
from PR #449, so it is this lane's own drift rather than inherited.

Verification

utilities/pre-push-verify.sh, whole workspace plus the nested fuzz workspace:
FMT_EXIT=0 CLIPPY_EXIT=0 TEST_EXIT=0 NESTED_WORKSPACE_EXIT=0 POLICY_SCRIPTS_EXIT=0 LOCKFILE_LOCKED_EXIT=0 — 1145 tests, 0 failed.

That run required fixing the harness itself, in metis-ops rather than here: its
nested-workspace phase ran cargo nextest run, and a workspace whose only
targets are fuzz binaries has no test targets, which nextest's default reports
as error: no tests to run (exit 4). Every branch touching fuzz/ was
therefore unpassable while the fuzz workspace was in its correct state. It now
passes --no-tests=warn, which still prints the zero-test line so an empty run
stays visible.