Remove dead helpers; fix usage and enable-flow doc drift

Andrew Dunnrequested to merge
cruft-cleanup into main

What

Cruft cleanup surfaced by a pre-v1.0.0 audit, plus two doc-accuracy fixes.

Removed (dead code, zero call sites, verified by grep)

  • vm_scp_recursive, emit_gitlab_ensure_helper (and its never-used Ruby gitlab_ensure helper), state_file, vm_curl_gitlab -- ~55 lines of never-executed code in simulator.sh.

Fixed

  • usage() drift: the engine's --help omitted eight real subcommands (rails-config, the four airgap-*, two-plane, validate, and the canonical enable-flows). Now listed, matching the dispatch and docs.
  • rails-config recipe: added so every documented subcommand has a front-door just recipe (closes the one gap from ADR-0001's single-front-door principle).
  • enable-flow precondition: documented in usage(), the just enable-flow recipe, and enable_flow.rb -- the standalone enable-flow needs the top-level group's foundational-flow allowlist already populated (run enable-flows/dap-bootstrap first), per the GitLab 18.11 API-order change. Verify-on-a-VM was attempted but the lab instance was unlicensed (Duo/Ultimate-gated), so this documents the precondition from the code evidence (commit 01caa02).
  • Stale docstring: enable_flow.rb pointed at a sync_foundational_flow.rb that never existed; now points at just sync-flow.

Checks

just ci clean (shellcheck confirms the removals broke nothing). Vale runs in the MR pipeline.

Merge request reports