Hollow work check: a pull that adds an exported action no route, page or MCP tool calls does not pass the gate #615

Pillar: P0 Trust (umbrella #586). One run, started fresh from today's main.

Outcome (what a person sees). Merged work is reachable work: the gate refuses a pull that adds an exported action nobody can call, so a release cannot carry hollow work (spawnForge sat with tests and no caller).

Acceptance.

• [ ] scripts/hollow.ts lists exported functions in src/actions/** that the diff against main adds and that nothing under src/http/, src/web/, src/crew/, src/cli/ or src/tui/ imports.
• [ ] It runs in the gate and fails with that list. An allowlist file takes entries with an owning issue each; seed it with today's hollow exports.
• [ ] Wiring it into the release workflow is the owner's choice: the pull says so and does not touch the workflow.

Done means reachable: the check runs in bun run check and a test proves it catches an uncalled export (no page or MCP tool applies).

Start from: forge.json (the check command), scripts/, src/actions/.

Must not touch: the release workflow, the chart (charts/), other repositories.