Say that the pipeline write path is test-only

Soul's F9 on the Cut 4 fix batch: `prepare` and
`validate_pipeline_write_envelope` still wore
`cfg_attr(not(test), expect(dead_code))`, and Soul proved both dead in a
non-test build. `prepare` was structurally unreachable — it needs a CultCache
with the pipeline types registered, and the only registrar has been `cfg(test)`
since this cut. A waiver that describes a caller Cut 8 has not written yet is
the file claiming a live path it does not have.

Both become `#[cfg(test)]`, which is what they honestly are, and the waivers go.
Two things are test-only with them: `decode`, whose only caller was the
validator, and the `CultCache`/`CultCacheEnvelope` imports, which looked live
only because dead code mentioned them. The live path keeps the type ids.

Cut 6 now moves four `cfg(test)` items rather than two live ones; the spec's
Keeps list still holds, since what moves is the same code under a different
gate. The refusal picture is unchanged: `ForeignStore` and `InvalidIdentity`
were already raised only from these two, and the enum stays `pub`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

epiphany-core/src/pipeline_documents.rs

@@ -17,7 +17,11 @@
 //! admission path, never by registering or preparing a pipeline type itself.
 
 use anyhow::Result;
-use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
+use cultcache_rs::DatabaseEntry;
+// Envelopes are a test-only shape here until the organ prepares, decodes and
+// validates them (Cut 8); only the type ids survive into the live path.
+#[cfg(test)]
+use cultcache_rs::{CultCache, CultCacheEnvelope};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
@@ -413,7 +417,11 @@ macro_rules! pipeline_kinds {
                 match self { $(Self::$variant(value) => value.validate($name)),* }
             }
 
-            #[cfg_attr(not(test), expect(dead_code, reason = "the organ's admission prepares writes through this"))]
+            /// Test scaffolding until the organ prepares writes (Cut 8). Every
+            /// caller is a test, and the only cache carrying these types is the
+            /// `cfg(test)` registrar beside it, so this is `cfg(test)` rather
+            /// than a live path wearing a dead-code waiver.
+            #[cfg(test)]
             pub(crate) fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
                 let key = pipeline_key(self)?;
                 Ok(match self {
@@ -423,6 +431,9 @@ macro_rules! pipeline_kinds {
                 })
             }
 
+            /// Test-only with its only caller, the write validator below, until
+            /// the organ decodes admitted envelopes (Cut 8).
+            #[cfg(test)]
             pub(crate) fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
                 let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
                 $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
@@ -573,8 +584,10 @@ pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefus
 }
 
 /// Bounds, formats, then key recomputation, for one envelope. Per-kind
-/// admission rules belong to the organ's admission path.
-#[cfg_attr(not(test), expect(dead_code, reason = "the organ's admission validates every write through this"))]
+/// admission rules belong to the organ's admission path. Its only caller is a
+/// test until the organ validates writes through it (Cut 8), so it is
+/// `cfg(test)` rather than a live path wearing a dead-code waiver.
+#[cfg(test)]
 fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<()> {
     let document = PipelineDocument::decode(envelope)?;
     document.validate()?;