#36184 Narrow crate-internal Rust visibility across all targets and delete the code it proves dead

Summary

Runs a multi-target visibility analysis over the Rust workspace with a fork of Astral's hawk (multi-target support upstreamed as astral-sh/hawk#150) so that pub items with no cross-crate use on any shipped platform are narrowed to pub(crate)/private. Once narrowed, rustc's denied dead_code/unreachable_pub lints can prove code dead across crate boundaries, and that code is deleted.

Three commits:

1. Make workspace test and doctest targets compile — cargo check --workspace --all-targets and cargo test --doc --workspace were rotted (test targets never compile in the normal build); needed as a precondition for the analysis. Rotted test helpers deleted, doc-comment diagrams fenced.
2. Narrow crate-internal visibility across all targets and delete the code it proves dead — the narrowing (~1000 files, net-zero LOC) plus the deletions it enables (~230 crate files): unused fns/methods/consts/statics/fields (with their write sites)/enums/imports, APIs used only by their own tests (deleted with those tests; surviving APIs keep coverage), and the never-constructed bun_safety::CriticalSection module. Items read only on one platform are #[cfg(...)]-gated instead of deleted.
3. codegen: exempt generated Rust from dead_code/unreachable_pub lints — generators emit #[allow(...)] on generated items so an unused generated item is a generator concern rather than a workspace compile error. Kept as a separate tip commit; happy to narrow to unreachable_pub only or drop it if you'd rather keep dead_code live on generated output.

Net: −1,941 lines over 1,061 files. (The narrowing is the enabler; the dead-public deletion pass — items no product root reaches at all — is the follow-up.)

Deliberately kept (reads invisible to rustc)

• Fields of MultiArrayList element structs (WatchItem, EntryPoint, JSMeta, InputFile, Store::Entry/Node, …) — read through generated items::<"field"> accessors.
• Ownership/liveness anchors — AsyncModule::ast_alloc_state, CurrentBundle::{bv2,heap,ast_alloc_state}, GC-protect handles, KEventWaker::machport_buf.
• Types type-punned through raw-pointer casts (SerializedSourceMap ↔ SerializedSourceMapLoaded).
• FFI structs still named in pub extern signatures; #[repr(...)] layouts untouched; no #[no_mangle]/extern items removed.
• PEFile::init keeps its per-section alignment-overflow validation after dropping the write-only fields it computed.

Test plan

• cargo check --workspace --all-targets clean on x86_64-unknown-linux-gnu, aarch64-unknown-linux-musl, x86_64-unknown-freebsd, aarch64-apple-darwin, x86_64-pc-windows-msvc
• cargo check with --cfg=bun_asan --cfg=socket_fault_injection clean
• cargo test --doc --workspace passes
• bun bd builds and links; debug binary smoke-tested (eval, TS run, Bun.serve round-trip, node:fs/path/crypto, spawn)
• test/js/bun/util/inspect.test.js (73/73), test/js/node/path/parse-format.test.js via bun bd test
• Restored crate unit tests pass: bun_collections 34, bun_paths 14, bun_clap 9, bun_base64 3
• Full CI matrix