v0.2.29: prune dead code and tighten the test gate #293

Pruning release, following v0.2.26 (test stack) and v0.2.27 (environment tooling).

What changed

• Dead scaffolding removed. web-vitals.ts and /api/vitals were never wired up (the route was an in-memory debug buffer and no client ever posted to it). src/lib/icons.ts re-exported a handful of lucide icons under a comment marked "example"; nothing imported it.
• Dead skill-icon components removed. The expertise grid already fell back to the SVG files under /assets/icons, so the six hand-drawn icon components, BaseIcon, the barrel, the registry, and their two test files were pure duplication. The expertise section now renders the <Image> fallback exclusively.
• react-icons dropped. The three brand glyphs (GitHub / Instagram / LinkedIn) came from react-icons for three icons used in ~10 files. They are now three local stroke components carrying the exact path data extracted from react-icons, so the glyphs render identically, and react-icons is gone from package.json. (The react-icons audit's earlier claim that the skill icons were react-icons was wrong -- they were hand-drawn BaseIcon components. Corrected here.)
• Hardening carried forward. tsconfig dropped allowSyntheticDefaultImports (redundant with esModuleInterop).
• Coverage ratchet. Thresholds 0.7/0.6/0.65/0.7 -> 0.84/0.73/0.82/0.83, against measured 84.94/75.95/83.73/87.04.
• Test output hygiene. vitest.setup.ts stubs HTMLCanvasElement.getContext (jsdom has none), removing six "Not implemented" lines per run; two a11y tests wrap their renders in act, clearing two more.
• next 16.4.5 with @next/bundle-analyzer matched to it.

What did not change

• The 722-line dead HorizonCinematicCanvas.tsx is kept (deliberate; nothing references it, but it was not pruned this release).
• The three remaining upstream warnings: THREE_CJS_DEPRECATED (once per run, in drei's CJS), the jsdom 35-instances startup cost (blocked by the same CJS interop), and the 27 CRLF files ( added in v0.2.28 handles future churn only).

Verification (all unpiped, by exit code)

• bunx biome check . -- 0 (207 files)
• bun run type-check -- 0
• bun run test:ci -- 259 tests across 34 files, coverage above the new thresholds
• bun run build -- 0
• bun run check:bundle -- within budget (1128.4 KB raw / 358.2 KB gzip, down from 1139.9 / 363.4)
• bun run test:e2e:smoke -- pass
• Playwright probe: zero failed image responses (every skill SVG still loads via the fallback path)
• bun audit: 2 moderate (Storybook's dev-only docgen chain), down from 5 (3 high) after the sharp override in v0.2.28

Scope notes

• No source behaviour change for users: skill icons render the same glyphs via <Image> instead of inline SVG, and the three brand glyphs render identically (path data preserved verbatim from react-icons).
• No CHANGELOG commit (per repo convention).
• No PR merge, no issue attachment -- that stays manual.