Remove over-engineered code paths flagged by the audit

[Sev7eNup]

A repo-wide sweep looked for code that a smaller solution would cover just as well: 994 source
files were read across 15 partitions, producing 109 candidates. Each one was then handed to a
skeptic tasked with refuting it — is there a second consumer, is the type mocked in tests, does
CLAUDE.md or a guard test mandate the structure, does the simpler variant actually work under
the dependency rules. 42 candidates fell there. These twelve are what survived.

Net effect: -299 lines of source, +360 lines of test.

Engine

• ReturnDataActivity: drop the refcounted per-execution semaphore registry. It guarded a
  single atomic ExecuteUpdateAsync, and the determinism it implied is explicitly not
  promised — docs/claude-reference.md documents last-write-wins on the whole JSON.
• WorkflowDbWriteMetrics: SaveChangesMeasuredAsync delegates to ExecuteMeasuredAsync
  instead of repeating its body; the duplicated catches collapse into one that keeps the
  cancelled/failure split. New tests pin the metric names, tags and ordering via a
  MeterListener.
• BaseRemoteActivity: delete the unreachable four-argument constructor and make
  _configuration non-nullable. All thirteen subclasses already passed a configuration, so the
  null-config branches in StartProgramActivity, PowerManagementActivity and
  WaitForConditionActivity were dead — and they silently permitted useShellExecute and
  skipped the path guards. Removing them is a net security gain.

Api / Mcp / Ai

• CmTraceFormatter: replace the hand-rolled in-place substitution loop with
  StringBuilder.Replace. Equivalence checked for multiple occurrences and overlap before the
  swap; a multi-occurrence test was added.
• Observability: drop four DTO records that were never constructed and three response fields
  that were always empty, plus their TypeScript mirrors.
• DefinitionDiff: replace the custom canonicalising serializer and its
  JsonEquals(a, b) => a == b wrapper with JsonNode.DeepEquals.
• LlmConfiguredProxy: drop the six-field cache record and its SequenceEqual comparison. It
  avoided constructing a WebProxy on a path capped at 20 requests per minute.
  IOptionsMonitor is still read per request, so the section stays hot-reloadable.

Frontend

• NodeLibrary: remove the 23-entry Tailwind colour table that shadowed the generated
  --act-* tokens without a dark variant, and read the shared activity visual instead. Six
  catalog types the table had missed (textFileEdit, forEach, startWorkflow, returnData,
  llmQuery, generateText) are now coloured instead of grey. Behaviour change: an
  unknown activity type now renders the runScript visual rather than a grey help icon — the
  price of matching the canvas.
• configClone: drop the skip-key registry for a provably empty set.
• SystemSettingsPage: the comingSoon branch was unreachable (ready: false exists nowhere
  in the repo); the nine-way || chain and ternary become a lookup record that doubles as the
  ?section= deep-link whitelist. A new vitest covers the sub-tab routing, which had none.

Tooling

• dev-reset.ps1: remove the SkipTests switch that defaulted to $true and therefore
  disabled its own block.
• Delete the MockRemoteSession test helper; its single caller now builds the mock inline like
  the other fifteen activity test files.

Verification

Scoped suites for every touched area plus the guard tests the changes trigger:
ActivityCatalogTests, ActivityConfigReferenceTests, ActivityCatalogFrontendSyncTests,
MetricsDashboardCatalogTests, AdminSettingsFrontendSyncTests, ApiDtoParityTests. Full
backend suite (5612) and full frontend unit suite (2657) pass; tsc --noEmit clean; no new
compiler warning in any touched file.

Stacked on #201 — merge that one first.