feat(entrypoints): file-convention and manifest matchers, level invariance, closeout (unit 5)

[rahlk]

Problem

Decorator-, call- and base-class-declared entrypoints are covered (#157, #159). Two declaration
forms with no python analog remain, and they are the common ones for non-web TypeScript:

• File convention — Next.js app/**/route.ts exports GET/POST; pages/api/*.ts default
  export; SvelteKit +server.ts. Nothing in the source names a framework; the path does.
• Manifest — package.json main and bin: what runs when the package is executed. The
  <root> of an Electron app, a CLI tool, a library's entry.

The shipped rules.yml already carries files: rules for Next.js and SvelteKit and a manifest:
block, and the loader accepts them — but no matcher consumes either, so they load and do nothing.

Unit 5 of docs/design/specs/entrypoint-detection.md
(#150), Tasks 7-9 of the plan.

Scope boundary

The file-convention matcher, the manifest matcher, the level-invariance test on a fixture where every
tier fires, gen:readme for --entrypoint-rules, and spec/issue closeout. The last unit.

Goals

• files: rules: glob over the module file key (**, *, {a,b}, anchored); each named export
  resolves to the exported callable (is_exported + name; default via the declaration's
  source text starting export default); route derived from the file key; methods: {from: export_name}
• manifest: rules: main/bin paths → the module (with dist/→src/ and extension
  fallbacks) → records on the free functions that module calls at top level, confidence: declared, via = the module id; a path that resolves to nothing is COUNTED
• Entrypoints identical at -a 1..-a 4, cold then warm, on a fixture where nestjs, the calls
  tier and the manifest tier all fire
• README --help block regenerated; spec open questions marked decided; feat(entrypoints): rules engine + shipped ruleset, at parity with python #72 goals ticked

Caveats and known risks

• TSModule.exports is EMPTY for export function / export default function / export const —
  the builder records only export { } and re-exports. Match on TSCallable.is_exported + name,
  and detect a default export by slicing mod.source at span.bytes.
• The manifest matcher's attach rule ("top-level-called free functions") is a decision this unit makes
  on the spec's open question; python has no module-level entrypoints, so no shared field is added
• noRepoSections (a --no-repo-sections flag) lives on the unmerged PR feat(cli): --program shard selector, --no-repo-sections, and shard IR #149 and is NOT on this
  branch; the manifest matcher's disk fallback is tested by a direct unit call with artifacts: {}
• File-convention rules are framework-version-sensitive (Next.js moved pages/api → app/**/route.ts
  across a major); both ship, and both must be expressible without a code change

Definition of done

• Next.js app-router and pages-api fixtures produce the expected records with routes and methods,
  gated on the next dependency; the same files without it register nothing
• main/bin produce declared records on the top-level-called functions; a dangling path is counted
• The invariance test passes cold-then-warm across all four levels with every tier firing
• bun test green; container tests run (final unit)