refactor: drop unused exports detected by fallow auto-fix

Run `fallow fix --auto-fixable` to remove `export` keywords from symbols
fallow's reachability analysis identifies as unused. Keeps only the cases
where the symbol is still referenced internally in its own file (so
removing `export` doesn't surface a new oxlint `no-unused-vars` error).

Result: fallow dead-code findings drop from 276 → 208 (68 fewer unused
exports), with no behavior change — each symbol is still defined and used
exactly the same way within its file.

Reverted ~20 files where fallow's auto-fix would have created cascading
"declared but never used" lint errors — those are cases where the symbol
isn't used at all, and properly cleaning them up means deleting the
declaration, not just dropping `export`. Better to land that as a
separate, narrower PR rather than mixing it into a mechanical de-export.

Also reverted four false positives where fallow missed real consumers:
- `captureCost.ts` (renderOrchestrator has two separate import blocks
  from the same module; fallow only saw the first)
- `propertyPanelHelpers.ts`, `domEditingLayers.ts` (real internal uses
  fallow's reachability missed)
- `render.ts` (functions imported via `await import()` dynamic import,
  which fallow's static analysis doesn't follow)

Test plan: bun run --filter '*' typecheck (clean), oxlint + oxfmt clean,
cli/core/studio/engine vitest suites pass (335 + 917 + 576 + 605 tests).

packages/cli/src/commands/lambda/policies.ts

@@ -56,7 +56,7 @@ interface TrustPolicyDocument {
  * Actions the CLI needs to deploy/invoke/destroy the stack. Keep this
  * sorted alphabetically inside each service so diffs stay readable.
  */
-export const REQUIRED_ACTIONS = {
+const REQUIRED_ACTIONS = {
   cloudformation: [
     "cloudformation:CreateChangeSet",
     "cloudformation:CreateStack",

packages/cli/src/commands/lambda/sam.ts

@@ -23,7 +23,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 
 /** Throws with a clear hint when the SAM CLI is not on PATH. */
-export function assertSamAvailable(): void {
+function assertSamAvailable(): void {
   try {
     execFileSync("sam", ["--version"], { stdio: "ignore" });
   } catch {
@@ -34,7 +34,7 @@ export function assertSamAvailable(): void {
 }
 
 /** Throws with a clear hint when the `aws` CLI is not on PATH. */
-export function assertAwsCliAvailable(): void {
+function assertAwsCliAvailable(): void {
   try {
     execFileSync("aws", ["--version"], { stdio: "ignore" });
   } catch {