test(entrypoints): coverage gaps and raw-text seams deferred by the final review

[rahlk]

Problem

The final whole-branch review of the entrypoint work (units 2-5, PRs #156/#158/#160/#161) triaged a
set of Minor findings as "defer to a follow-up issue" — none blocks merge, all share one theme:
coverage gaps and raw-source-text seams in the matchers. Collected here so they are tracked, not lost.

Scope boundary

Tests and small matcher hardening only. No schema, no Neo4j, no rules-format change.

Goals

Coverage (each is a few lines; the code paths exist and were verified by inspection or probe):

• Calls-tier never-doubles against a LIVE framework claim — now writable: app/x/route.ts exporting
  GET and calling app.get('/x', GET) in the same file (a files: claim on the handler)
• entrypointsFromBases: transitive: false must not walk; empty dispatch: [] yields only the class record
• File-convention gate: a package.json with UNRELATED dependencies (proves the gate keys on the name,
  not on manifest presence)
• Manifest: a module that resolves but has no receiverless call to a free function is counted

Raw-text literal decoding seam (literalOf/routeOf read source fragments, not an AST):

• literalOf splits a […] list on bare ,, so ['a,b'] loses the element
• routeOf sets route from an array-valued positional via firstString() (spec wording says "a string")
• isSignature (unresolved counter) classifies a lowercase-headed dotted spelling (ns.Thing, ns not
  imported) as an in-project signature, so it escapes the counter

Handler binding:

• resolveHandler binds a bare identifier to the first callable of that name across the whole module —
  including class methods — so app.get('/p', handler) can bind to a method named handler declared
  earlier. Prefer mod.functions (free functions) before any other callable.

Convention note:

• routeFromFileKey("pages/api/index.ts") → /api/index where Next serves /api; decide whether
  index files collapse, and pin it either way

Caveats and known risks

• literalOf is documented as deliberately narrow; widening it toward AST-grade decoding is out of scope —
  the fix is to fail visibly (count or undefined), not to parse more
• The never-doubles collision test depends on the files: tier, which lands with feat(entrypoints): file-convention and manifest matchers, level invariance, closeout (unit 5) #161

Definition of done

• Every checkbox above has a test that fails against the current code where a behaviour changes, and
  passes after
• bun test green; no change to rules.yml, SCHEMA_VERSION, or src/build/neo4j/**