Wire staticcheck and deadcode, and gate both on a baseline (V-694)

The 2026-08-10 audit asked for three analyzers. V-682 wired the first as `make
vuln`. The other two were still absent: neither was installed on the box and no
target ran them, so every reachability claim in the audit stood unchecked.

`make lint` runs staticcheck v0.7.0 and `make deadcode` runs deadcode v0.48.0.
Both are pinned in the Makefile beside GO_VERSION and installed into deps/bin
the way govulncheck is, because a tool is not a dependency of the module. Both
carry the CGO env `test` carries, or the four CGO daemons fail to load and the
analyzer reports a build error instead of a finding. `make analyze` runs all
three. None joins `make test`: they install over the network and `test` has to
pass on a box with no route out.

Neither reports zero, so neither fails on its own output. staticcheck finds 20
and deadcode finds 13, and the audit asked for an allowlist by name, because
three of deadcode's eleven production symbols are deliberate and an unannotated
list invites deleting them. The accepted set lives in
scripts/analyzers/*.baseline, one line per finding with the reason it stays, and
scripts/analyzer-gate.sh gives the verdict. A key holds file, check id and
message, never a line number: a line number goes stale on the next edit above
it, and a gate that reports moved findings as new ones teaches the reader to
skip it. An entry whose finding is gone also fails, so a fix that leaves its
line behind does not pass.

deadcode runs with -test, because a test is a caller. Without the flag the
report is 172 lines, most of internal/router/eval, and none of it is a mistake.
With it, the 11 symbols the audit listed come back exactly, plus two test
helpers it did not count.

Three staticcheck findings were checked and are false positives, recorded as
such: the iCal determinism test must call RenderICal twice, the morning hedge
loop breaks after the first rune on purpose, and the SA9009 line is prose about
//go:embed with the real directive below it. One is V-687 already. The remaining
17 are V-701 with the judgement on each.

The analyzers caveat is deleted rather than edited. What replaces it is the
limit that is now true: the gates are green against a baseline, not against
zero.

docs/caveats/CLAUDE.md

@@ -21,10 +21,11 @@ caveat is the pointer between them plus the trigger.
 ## Index
 
 Every entry below came from the 2026-08-10 deep audit
-(`docs/evals/2026-08-10-repo-audit.md`). Two of the twenty findings are fixed
-and have no entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable
-advisories in the toolchain and `x/text` were V-682, which left the analyzers
-entry below behind under its own id.
+(`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring
+the gate the audit asked for. Three of the twenty findings are fixed and have no
+entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories
+in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and
+what they now report is the baseline entry under V-701.
 
 | limit | severity |
 | --- | --- |
@@ -44,6 +45,6 @@ entry below behind under its own id.
 | [baselineGrammars is mirrored by hand](invariants.md#grammars) | medium |
 | [Committed absolute paths pin the build to this box](config.md#paths) | medium |
 | [The env example omits deployed variables](config.md#secrets) | medium |
-| [staticcheck and deadcode are not wired into a make target](dependencies.md#analyzers) | medium |
+| [The analyzers pass against a baseline, not zero](dependencies.md#baseline) | medium |
 | [Domain packages depend on store and IPC types](layering.md#dtos) | low |
 | [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/dependencies.md

@@ -1,14 +1,13 @@
 # Dependencies
 
-## staticcheck and deadcode are not wired into a make target [#694] {#analyzers}
+## The analyzers pass against a baseline, not against zero [#701] {#baseline}
 
-Costs: two of the three analyzers the 2026-08-10 audit asked for are missing.
-Neither is installed on this box and no target runs them. `make audit` is a git-grep
-inventory over loc, todo, stubs, docs, tests and gaps. **Do not read it as a
-static-analysis gate.** `make vuln` is the third one and it is wired (V-682):
-govulncheck is pinned in the Makefile, installed into `deps/bin` and run over
-`./...`. It reads the published database over the network, so it stays out of
-`make test`.
-Revisit when: the next dead-code claim needs checking. `deadcode` has a finding
-waiting for it in [layering.md](layering.md#deadcode).
-Workaround: none. Read a reachability claim as unverified until one of them runs.
+Costs: `make lint` and `make deadcode` are wired and green (V-694), but green
+means "nothing new since 2026-08-11". The accepted set is 19 staticcheck
+findings and 13 unreachable symbols, listed with a reason each in
+`scripts/analyzers/*.baseline`. Three of the unreachable symbols must stay:
+[layering.md](layering.md#deadcode). One accepted staticcheck finding is V-687.
+Revisit when: V-701 sweeps the baseline, or a fix deletes an entry. The gate
+fails on an entry whose finding is gone, so the deletion is not optional.
+Workaround: none needed. Reachability claims are checkable now. Read the
+baseline before trusting that a target reporting clean means the tree is clean.