chore: Clean up dead code (unused sentinels, deprecated function, thin wrappers)

[jflowers]

Summary

Several pieces of dead or near-dead code exist that should be cleaned up per the zero-waste mandate.

Findings

1. Unused sentinel errors in internal/ollama/client.go:20-31

var ErrOllamaUnavailable = errors.New("ollama is not running or unreachable")
var ErrModelNotAvailable  = errors.New("requested model is not available")

These are defined but never referenced. The actual error handling in main.go uses inline fmt.Errorf messages. ErrMalformedResponse IS used.

Fix: Either use these sentinels in main.go (replacing inline messages for consistent error typing) or remove them.

2. Deprecated generateEnvFile in selfservice.go:874-904

Marked // Deprecated and documented as backward compatibility. The project has fully migrated to config.yaml.

Fix: Search for callers. If none exist, remove the function.

3. Thin wrappers in main.go and auth_config.go

• truncateText (main.go:489-491) wraps ux.TruncateText — only 1 call site
• maskSecret (auth_config.go:174-176) wraps ux.MaskSecret — only 1 call site

Fix: Replace call sites with direct ux.TruncateText / ux.MaskSecret calls and remove wrappers.

4. Variable shadowing in ollama/decisions.go:119

Local validCategories shadows the package-level validCategories in guardian.go. Different values, confusing naming.

Fix: Rename to validDecisionCategories to distinguish from sensitivity categories.

Priority

LOW — Code hygiene, no functional impact.