feat(devx): discover check-route-envelope's express population instead of enumerating it (#9937) (#10351)

Surface 4 shipped enumerated in #9813 — one file named by hand — because a
discovery walk for the express dialect needs something the other three surfaces
never did: a read/write discriminator. `res.json` is one spelling for two
opposite acts, and the reading half is the majority of it in this repo:

    res.json({ success: true, data })     // express WRITE, one argument
    const body = await res.json();        // fetch READ, zero arguments

Measured on origin/main (736cfb1) BEFORE widening the population, because the
cost of being wrong is a gate that reddens on innocent files — 301 `res` `.json`
calls under packages/: 218 writes in 7 files, 83 reads in 13 others, and not one
file mixes them. Argument count alone would sweep in 11 DSL files
(`Field.json({…})`, `t.json(c.name)`); the receiver name alone would sweep in all
13 fetch readers, 65% of the 20 files touching the spelling. Together: zero false
positives.

- `discoverExpressRoutes()` walks packages/ and refuses any undeclared express
  writer, mirroring surface 3. Both walks now share `discoverResponseWriters()`,
  so the two populations cannot drift apart in whichever copy nobody edits.
- Both express spellings count: `res.json(body)` (81 calls) and the chained
  `res.status(400).json(body)` (137) — the second is where the refusals live, so
  a bare-form-only walk would count the successes and miss the errors.
- The discriminator is self-tested in BOTH directions, the reject side asserted
  positively as `reads: 1` rather than as `bodies: 0` — a count a scanner that had
  simply stopped matching the receiver would also produce. The audit prints the
  reject side too (13 files skipped as fetch readers), since a walk can otherwise
  only ever show what it swept in.
- First-audit verdict for all 3 newly swept-in files: `inbound-rate-limit.ts`
  conformant (its 429 goes through `buildApiError`); `query-allowlist.ts` and
  `query-multiplicity.ts` ratcheted at `unenveloped: 1` each — the shared 400
  refusals are ADR-0112-nested already but carry no `success` above it.
- `IHTTP_ROUTE_MODULES` becomes `EXPRESS_RESPONSE_MODULES`: the walk found a
  middleware and two refusal helpers, none of them route modules, and the repo
  types its handlers `any` at exactly the seam a mounting-mechanism split would
  need. The dialect is the population — the third open question in #9937.


Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang