Bind session runner export boundary evidence

[svy04]

Summary

• remove the test-only _extractActivitiesForTesting export from src/bridge/sessionRunner.ts
• add a behavioral public-export boundary test so the internal activity parser stays private
• move the Knip triage item from unresolved review into a removed-candidate ratchet, and update static-analysis queue/claim/evidence reports without cleanup-readiness claims

Verification

• bun test src/bridge/sessionRunner.test.ts scripts/product-dead-export-candidates.test.ts scripts/product-static-analysis-remediation-queue.test.ts scripts/public-repo-readiness.test.ts
• bun run build
• bun run typecheck --pretty false
• bun run verify:privacy
• bun run product:quality

Boundaries

• no provider, live model, external deploy, publish, or protected release action was performed
• this does not claim dead-export cleanup completion, topology cleanliness, production readiness, or external validation