[codex] Extract shared no-provider command helper

[svy04]

What changed

• Added a shared quality-command-helpers runner for local no-provider package commands.
• Rewired the dead-export and dependency-topology product gates to use the shared runner while preserving each gate's own normalize/preview behavior.
• Lowered the jscpd ratchet from 17 to 16 clone pairs and refreshed the static-analysis remediation queue evidence.

Why

Community feedback called out generated product-script clone clusters and audit surfaces that were too structural. This PR removes the current top jscpd clone pair with focused characterization coverage instead of treating jscpd as an autofix engine.

Validation

• bun test ./scripts/quality-command-helpers.test.ts ./scripts/product-dead-export-candidates.test.ts ./scripts/product-dependency-topology.test.ts ./scripts/product-script-duplication-audit.test.ts
• bun run product:static-analysis-remediation-queue
• bun run build
• bun run typecheck --pretty false
• bun run product:quality
• bun run verify:privacy
• git diff --cached --check
• staged diff scan for local paths and common secret token patterns

Claim boundary

This proves one behavior-preserving extraction and a smaller jscpd ratchet. It does not claim broad refactor completion, production readiness, or external validation.