chore: code quality cleanup

[araujof]

Summary

Removes dead code across crates and resolves aislop findings, with documentation touch-ups.

• Remove dead code across Rust crates and Go bindings
• Fix findings in rust docs and drop internal plan/spec cross-references from comments

Code changes

The PR is ~95% comment and doc cleanup. Actual code changes are confined to three files.

Behavior change

• crates/cpex-ffi/src/lib.rs — cpex_wait_background: the null bg_handle path used to rmp_serde::to_vec_named(&empty).unwrap(). It now matches the result and returns RC_SERIALIZE_ERROR instead of panicking across the FFI boundary. Serializing an empty vec never actually fails, so the practical effect is nil, but the failure mode changed from panic to typed error code.

Panic-safety only (no behavior change)

• crates/cpex-ffi/src/lib.rs — alloc_bytes / cpex_free_bytes: Layout::from_size_align(...).unwrap() → .expect(...). Message only.
• crates/apl-core/src/parser.rs — six .unwrap() → .expect("... checked above") in the parse helpers, each guarded by a prior length check.

Refactor (pure code movement)

• crates/apl-core/src/parser.rs — parse_stage's inline match arms (mask, redact, len, enum, regex, validate, plugin/run) extracted into seven private helper functions. The validate(...) compile-time rejection and empty-plugin-name guard are preserved verbatim.

Cleanup (behavior preserving)

• builtins/plugins/elicitation-ciba/src/approver.rs — parse_duration_secs: replaced if s.is_empty() { return None } + .chars().last().unwrap() with let last = s.chars().last()?;. Empty input still yields None.

Cosmetic (no logic)

• crates/apl-core/src/evaluator.rs — comment edits only.
• go/cpex/identity.go — gofmt re-alignment of the TokenSource* const block (string values unchanged) plus comment edits.

No public API, signatures, struct fields, enum variants, dependencies, or test assertions changed.

[terylt]

LGTM