Blue team tasks: fix transport dedup, migrate CI generation to DSL

[briansrls]

BT-E1: Fix transport node deduplication bug in daglang-lower where
endpoint_use_count HashMap was declared inside per-module loop, causing
cross-module service calls to wire duplicate edges to shared prepare nodes.
Moved declaration outside the loop so counts are tracked globally.

CG-1:5: Migrate CI YAML generation from Rust to DSL:

• Create dsl/std/ci.dag with CI model types (CiWorkflow, CiJob, CiStep,
  CiTrigger, CiPermission, CiCache, CiCheckout, CiRunner, CiProvider)
  and tautological data (rust_cache, cargo_ci_env, default_checkout)
• Create dsl/std/ci_render.dag with pure rendering functions for both
  GitHub Actions and GitLab CI (15 composable fn items)
• Create dsl/tools/cigen.dag with extern func discover_ci_config() bridge
  and func cigen() entrypoint that renders both providers via content_upsert
• Wire cmd_cigen() in codegen_cli.rs to DSL tool via
  build_dsl_graph_for_entrypoint, deleting ~160 lines of Rust generation code
• Add DiscoverCiConfigOp extern impl serializing permissions, secrets,
  and tool commands from workspace metadata
• CG-5 evaluated: all RenderConfig/CiRenderer code still actively used
  by provider impls and makegen/ci_render.rs — no dead code to remove

CT-4: Update annotation cleanup status to Done in tasks.md.

Test infrastructure updates:

• Extern ratchet baselines: 2→3 declarations, 6→7 impls
• Corpus inventory: add 3 new .dag files
• Module graph snapshot: add 3 new module dependency counts
• Passthrough callable allowlist: add 7 new entries
• Makefile golden snapshot: regenerated with cigen tool target
• Tool registration: add cigen to non-workspace-dispatch exclusion
• Commit policies: CI YAML files as BootstrapSeed

https://claude.ai/code/session_01PTAqwMfMHhNuCpCwPYThoP