Repository hygiene: a test that cannot fail, dead components and imports, stale docs #160

Found while running clippy and a dead-code / docs pass over main (894ea12).

A test that cannot fail

creation_defaults_and_supplied_values_share_the_resize_bounds (desktop/src-tauri/src/commands.rs:1541) is meant to keep terminal creation bounded the same way a resize is. It rebuilds the default handling from literals (Some(24_u32).unwrap_or(24), flagged by clippy::unnecessary_literal_unwrap) instead of calling the code that create_local_terminal and connect_ssh run. If either command went back to a plain as cast, so that 65536 columns opened a 0-column PTY, the test would still pass.

Dead code

• Sidebar.vue, SplitView.vue, ui/Separator.vue and ui/Tooltip.vue are not imported anywhere.
• RefreshCw in UpdateModal.vue and cn in ui/button-variants.ts are unused imports.
• thiserror is a dependency of clavyn-desktop with no uses.
• clear_bound_credential is imported by vault_keychain_cleanup.rs's tests but used only under cfg(target_os = "macos"), so every Linux and Windows test build warns about it.

Docs that no longer match the code

• Bundle output path. README and AGENTS.md put bundles under desktop/src-tauri/target/release/bundle. It is the workspace target/ at the repo root, which scripts/release.sh already uses.
• Node version. README says Node 18+. vite 8 and vitest 5 need 22.12+ (or 24), and CI uses 22.
• Stale stack descriptions. README and ARCHITECTURE describe key handling through russh-keys (gone) and a "minimal HTML/JS" frontend (it's Vue 3 + Pinia). ARCHITECTURE lists an initialize_vault command (now secure_initialize_vault) and a PrivateKeyMaterial type that no longer exists.
• What the e2e fixture mocks. AGENTS.md, scripts/verify/README.md, the verify skill and control-clavyn.mjs say the e2e fixture mocks "the full Tauri IPC surface". It mocks the terminal, SFTP and vault-status calls and throws Unhandled test IPC for the rest (add_host, generate_key, secure_unlock_vault, …), which surprises anyone driving a new flow through the harness.
• Placeholder repository URL. Cargo.toml has repository = "https://github.com/your-org/clavyn".

Comments that narrate history

core/src/connection.rs:282 ("Agent used to masquerade…") and desktop/src-tauri/src/host_key_prompt.rs:320 ("used to leave open set") break the comment rule. check-comments.mjs does not flag them. A plain used to pattern can't tell these apart from present-tense uses like "the identity used to authenticate", so the scanner stays as it is and the comments are rewritten by hand.

Left for later

• cargo fmt / cargo clippy in CI. 133 rustfmt hunks across 25 files; adding the gate means a whole-tree formatting commit, which would conflict with every open PR. Better done once the current security PRs have merged.
• Dead code in areas other open PRs touch. SftpManager::read_file/write_file (rewritten by Keep the session maps unlocked across network I/O #140), the unused list_sessions command (listed in Put the app's commands behind the capability ACL, trim plugin grants, keep the window on the app's pages #123's ACL) and GithubRelease.prerelease (touched by Bind update signatures to their version and take manifests only from our releases #144). Better removed once those land.