feat(scripts): check:route-envelope audits rest-server.ts — dialect facts only (#7295) (#7459)

`discover()` collected `*-routes.ts` plus one named exception, so
`packages/rest/src/rest-server.ts` — the largest response-emitting file in the
repo (#5949), 208 hand-built write sites — had never been audited by the gate
whose own header promises that "a module nobody thought to convert still gets
audited".

Per the maintainer ruling of 2026-08-10 (option 3), it is now discovered and
held to DIALECT FACTS ONLY, never to `responses`: a write-site ratchet on a file
that changes several times a day would go red for edits that are not envelope
drift, and the pressure would be to raise the number rather than fix anything
(option 2, rejected).

- `discover()` takes an `OFF_CONVENTION_MODULES` set — `i18n-service-plugin.ts`
  as before, plus `rest-server.ts`.
- New `siblingCode` counter: a top-level `code` as a SIBLING of `error` instead
  of a key inside it — the second dialect from #7035, which no counter here
  could see. Shorthand (`{ error, code }`) is the same dialect; nested
  (`{ error: { code, message } }`) is the conformant envelope and is not counted.
  Asserted for every audited module, defaulting to 0.
- New `dialectOnly` module state, exclusive with `responses`/`ok`/`err`/
  `privateOk` and requiring a `ratchet`. Its two counts ratchet in ONE
  direction: an increase is a new non-conforming body, and a decrease must be
  banked by lowering the baseline.
- Baseline measured on this branch point, not assumed: stringError 44,
  siblingCode 77.
- Self-test: three positives (literal pair, computed message, shorthand) and
  four negatives (nested code, code inside `data`, a lone `code`, commented-out
  prose).

`packages/rest/src/rest-server.ts` itself is untouched — converting it onto the
shared sendOk/sendError is #7035 option 1 and stays out of scope.


Claude-Session: https://claude.ai/code/session_01NRQebqrpJZU1tJZpzYy3xL

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-help