docs(tasks): decompose review-002 into 24 tasks (23 implementation + 1 bracketed follow-up)

Decomposition of docs/reviews/002-post-remediation-review.md per its
5-unit remediation plan:

- Unit 1 (security-critical): gw15-publish-body-cap,
  prj16-schema-via-call (CF-004 filed alkcall-side), fwd13-dot-segments,
  fwd16-missing-capability, oai11-ref-memoization
- Unit 2 (timeout/terminality): ws13-idle-progress,
  fwd15-stream-timeout, cli01-retry-after-budget, con17-mcp-pagination,
  con18-wss-sweep-exit
- Unit 3 (projection/docs): projection-truthfulness, mcp-batch-cap,
  gw16-status-drift
- Unit 4 (spec-import): yaml-normalization, oai13-path-item-wildcards,
  import-loudness-cluster, js01-placeholder-check,
  fwd17-19-contract-decisions
- Unit 5 (WS polish + tests): con18b-ws-polish,
  client-policy-wire-tests, cov-deployment-knobs, cov13-dead-code,
  srv11-srv12-router-ordering
- review-002-bracketed-followup: tentatively planned post-bulk pass
  (stale-check, OQA-18 enforcement decision, CON-08/09 close() lever,
  cross-crate re-checks) — deliberately not serialized against the
  bulk

Also: review-002 numbering repair (CON-14 was double-booked; MCP
pagination now CON-14, from_wss monitor renumbered CON-18, missing
CON-14 section added).

taskgraph: 66 valid, no cycles; 24 pending (all review-002);
gen-1/gen-2 parallel waves identified; workflow-cost hotspots are
prj16 (12.8) and ws13 (11.1), both carrying the reviewed slicing
guidance in their Notes.

tasks/infra/review-002-cov13-dead-code.md

@@ -0,0 +1,55 @@
+---
+id: review-002-cov13-dead-code
+name: Delete dead accessors and FromRef impls — resolve_bearer wire-or-delete decision (COV-13)
+status: pending
+depends_on: []
+scope: single
+risk: low
+impact: component
+level: implementation
+tags: [infra, review-002, coverage]
+---
+
+## Description
+
+Review 002 COV-13: code confirmed dead by the coverage pass (every
+binary, zero hits, nothing extracts these types) — delete rather than
+test:
+
+- `server/state.rs:75-83` — both `FromRef` impls
+  (`Arc<OperationRegistry>`, `Arc<dyn IdentityProvider>`): no route
+  extracts these types (the middleware takes state directly)
+- `gateway/dispatch.rs:74-76, 79-81` — `identity_provider()` accessor
+  (dead) and `resolve_bearer()` accessor — the latter's doc **promises
+  an auth hook the middleware never calls** (spec/code drift): decide
+  wire-or-delete (if the hook concept matters for a future assembly-
+  layer story, wire it into `bearer_auth_middleware`/`ws_bearer_auth`;
+  otherwise delete)
+- `websocket/upgrade.rs:145-147` — `FromRef<SessionState> for
+  Arc<OperationRegistry>` (dead extractor)
+- `to_mcp.rs` — `PRJ-24`'s dead `search_filter` parameter is owned by
+  review-002-projection-truthfulness; only handle it here if that task
+  did not
+
+## Acceptance Criteria
+
+- [ ] All dead items deleted (or resolve_bearer wired, with the doc
+      claim made true, if the hook decision says wire)
+- [ ] `cargo build` + full test matrix green — the deletions prove
+      nothing referenced them (coverage claim verified)
+- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
+      `cargo fmt --check` pass
+
+## References
+
+- docs/reviews/002-post-remediation-review.md (Part G', COV-13)
+- src/server/state.rs:75-83, src/gateway/dispatch.rs:74-81, src/websocket/upgrade.rs:145-147
+- tasks/infra/review-002-cov-deployment-knobs.md (the coverage pass's live-code work — separate from this dead-code sweep)
+
+## Notes
+
+Small, zero-risk deletion sweep. Good pairing with any other session's
+warm-up. If the `resolve_bearer` hook-decision feels non-obvious
+(needs an ADR or design note), default to delete — dead code with an
+aspirational doc claim is worse than no hook; a real hook can be added
+when a concrete assembly-layer need exists.