refactor(prover): remove legacy unused reachability constraints

[eviehoward]

Summary

Removes can_write_to_endpoint() and the solver variables and encoding methods that exist solely to support it. The active query layer uses can_exfil_via_endpoint() and direct credential lookups exclusively; the removed Z3 encodings were scaffolding for query categories that were never implemented or were later cut. Confirmed zero callers across the monorepo; crate is not published externally and no release notes reference its public API surface.

Also removes three dead write-capability helpers from registry.rs that lost their only callers as a direct consequence of the model.rs cleanup.

Related Issue

Closes #2412

Changes

• Removed can_write_to_endpoint() — zero callers confirmed across the monorepo
• Removed binary_can_write, credential_has_write — only consumed by can_write_to_endpoint()
• Removed credential_has_destructive, filesystem_readable — directly dead, previously silenced with #[allow(dead_code)]
• Removed encode_credentials(), encode_filesystem() — exclusively populated the above fields
• Removed two #[allow(dead_code)] allowances, HashMap::new() initialisers, and the encode_credentials() / encode_filesystem() calls inside build().
• Removed BinaryProtocol::can_write(), BinaryCapability::can_write() — made dead by the model.rs cleanup above
• Removed write_mechanisms() — pre-existing dead code, no callers prior to this series

Follow-up Dead Code

This PR leaves behind two dead code clusters that are out of scope here but should be tracked:

1. registry.rs - write action data layer (caused by this PR). Removing can_write() and write_mechanisms() orphaned their only consumers of BinaryProtocol::actions, BinaryAction, and ActionType::Write/Destructive. The data is still loaded from YAML at parse time but never queried.
2. credentials.rs - API registry subsystem (pre-existing, surfaced by this PR). write_actions_for_scopes and destructive_actions_for_scopes were killed here (their sole caller encode_credentials() was removed). The cascade beneath them - actions_for_scopes, ApiCapability, ApiAction, and all associated loaders and serde types - was already dead before this PR. This is the full API registry subsystem in credentials.rs, which was never fully wired up.

To avoid scope creep I have omitted these from this PR but can address it here if preferred - left as a follow-up outside scope of this PR for now.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

cargo test -p openshell-prover passes. No new tests added — existing tests (test_findings_for_github_policy, test_wildcard_endpoint_covering_credential_host_emits_credential_reach, test_known_metadata_hostname_emits_link_local_finding, test_empty_policy_no_findings) cover all four active finding categories end-to-end. can_write_to_endpoint() was never invoked by prove() or any live query path — no test could have detected its presence or absence.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable) — no architecture doc covers prover model internals

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.