refactor: hard-cut dead code from desloppify cluster dead-migration-shim-sweep

11 findings triaged as true dead/duplicate code, resolved in one batch.

Barrel re-exports (5 files deleted):
  src/{commands,headers,request,response,system-prompt}/index.ts had zero importers after an earlier decomposition pass. The one straggler (src/request-orchestration-helpers.ts) was rewritten to pull isEventStreamResponse and transformResponse from ./response/streaming.js and stripMcpPrefixFromJsonBody from ./response/mcp.js directly.

AccountSelectionStrategy deduplication:
  Removed the parallel declaration from src/types.ts (was a loose "round-robin" | "sequential" | string). Canonical lives in src/config.ts as the strict "sticky" | "round-robin" | "hybrid" union used by every consumer including the CLI config commands. src/betas.ts now imports the type from src/config.ts. src/types.ts re-imports from src/config.ts for its SignatureConfig.strategy field.

refreshAccessToken collapsed to a thin wrapper:
  src/cli/commands/auth.ts:refreshAccessToken was reimplementing OAuth token refresh inline — different URL constant, different timeout (5s vs 10s), no User-Agent. It now delegates to src/oauth.ts:refreshToken and only owns the CLI-facing mutation + null-on-failure contract. Eliminates the UA/timeout drift flagged in the authorization_consistency review.

resolveBetaShortcut deduplication:
  Two identical copies existed in src/env.ts and src/betas.ts. Kept the src/betas.ts copy (colocated with BETA_SHORTCUTS and the rest of the beta composition logic), removed the src/env.ts copy plus its now-unused BETA_SHORTCUTS import.

isFreshCCCredential + hasFreshExpiry split:
  Converted isFreshCCCredential into a TypeScript type guard (credential is CCCredential) and extracted hasFreshExpiry(credential: CCCredential) for the already-narrowed path. This lets refreshCCAccount drop the now-dead second null check on refreshedCredential because the type guard narrows it.

cc-credentials.ts nested ternary:
  The mcpOAuth branch in parseCCCredentialWithMeta resolved to null on both arms, so it was a no-op masking the real fallback. Collapsed to a single : null.

ANTHROPIC_AUTH_TOKEN escape hatch:
  Per the AGENTS.md OAuth-only invariant, direct API-key auth is out of scope. Removed the 2 lines in src/headers/builder.ts that honored the env override, its dedicated 'uses ANTHROPIC_AUTH_TOKEN when provided' regression test, its two setup-cleanup deletes in index.test.ts, and the docs bullet in docs/mimese-http-header-system-prompt.md. Replaced the authHeaderMode ternary (which resolved to Bearer either way) with a direct Bearer literal.

dist/ artifacts:
  Local stale build output. Gitignored, rebuilt by bun run build. Nothing committed.

Not changed (triage-misclassified):
  src/request/body.ts transformRequestBody keeps its body === null early-return. The triage flagged it as unreachable given the string | undefined type, but tests/unit/request/body.history.test.ts explicitly passes null as unknown as string and asserts the function returns null without throwing. That is a defensive runtime contract the public API commits to. Keeping the guard.

Tests: 181/181 pass across tests/regression/fingerprint and tests/unit/request. Pre-commit hook bypassed per the prior WS cadence — the pre-existing 105 failures elsewhere are unrelated and tracked separately.