Coverage gaps and raw-text seams deferred by the final review

[rahlk]

Is your feature request related to a problem? Please describe.

The final whole-branch review of the entrypoint work (units 2-5, PRs #156/#158/#160/#161) triaged a set of Minor findings as "defer to a follow-up issue" — none blocks merge, all share one theme: coverage gaps and raw-source-text seams in the matchers. Collected here so they are tracked, not lost.

Describe the solution you'd like

Coverage (each is a few lines; the code paths exist and were verified by inspection or probe):

• Calls-tier never-doubles against a LIVE framework claim — now writable: app/x/route.ts exporting GET and calling app.get('/x', GET) in the same file (a files: claim on the handler)
• entrypointsFromBases: transitive: false must not walk; empty dispatch: [] yields only the class record
• File-convention gate: a package.json with UNRELATED dependencies (proves the gate keys on the name, not on manifest presence)
• Manifest: a module that resolves but has no receiverless call to a free function is counted

Raw-text literal decoding seam (literalOf/routeOf read source fragments, not an AST):

• literalOf splits a […] list on bare ,, so ['a,b'] loses the element
• routeOf sets route from an array-valued positional via firstString() (spec wording says "a string")
• isSignature (unresolved counter) classifies a lowercase-headed dotted spelling (ns.Thing, ns not imported) as an in-project signature, so it escapes the counter

Handler binding:

• resolveHandler binds a bare identifier to the first callable of that name across the whole module — including class methods — so app.get('/p', handler) can bind to a method named handler declared earlier. Prefer mod.functions (free functions) before any other callable.

Convention note:

• routeFromFileKey("pages/api/index.ts") → /api/index where Next serves /api; decide whether index files collapse, and pin it either way

Describe alternatives you've considered

Not stated in the original issue.

Additional context

Scope boundary

Tests and small matcher hardening only. No schema, no Neo4j, no rules-format change.

Caveats and known risks

• literalOf is documented as deliberately narrow; widening it toward AST-grade decoding is out of scope — the fix is to fail visibly (count or undefined), not to parse more
• The never-doubles collision test depends on the files: tier, which lands with feat(entrypoints): file-convention and manifest matchers, level invariance, closeout (unit 5) #161

Definition of done

• Every checkbox above has a test that fails against the current code where a behaviour changes, and passes after
• bun test green; no change to rules.yml, SCHEMA_VERSION, or src/build/neo4j/**