chore(fallow): adopt fallow and fix dead-code findings

- add fallow 3.17 as workspace devDependency with fallow/fallow:fix scripts
- generate .fallowrc.json modeling pi.extensions entries, diagnostic CLI, and tools as entry points
- remove export from 4 internal-only symbols
- drop unused pi-ai dependency from pi-permission-inner-cmd

.fallowrc.json

@@ -0,0 +1,29 @@
+{
+  // This file is JSONC: fallow reads these comments; generic JSON tools may not.
+  "$schema": "./node_modules/fallow/schema.json",
+  "entry": [
+    "packages/*/src/index.ts",       // pi.extensions entry points
+    "packages/pi-permission-ai-judge/src/analyzer/cli.ts",  // manual diagnostic CLI
+    "packages/pi-permission-ai-judge/tools/*.ts"            // manual replay tools
+  ],
+  "workspaces": {
+    "patterns": [
+      "packages/*"
+    ]
+  },
+  "duplicates": {
+    // Hide pair-only clones; focus on widespread copy-paste
+    // worth refactoring. Lower to 2 to report every duplicate pair.
+    "minOccurrences": 3
+    // Common additions (uncomment to enable):
+    // "ignore": [
+    //   "**/lib/**",          // for repos that publish transpiled output to lib/
+    //   "**/legacy/**",       // for repos with legacy-build artifacts
+    //   "**/__generated__/**", // Relay, GraphQL Code Generator
+    //   "**/generated/**"     // OpenAPI, Protobuf codegen
+    // ]
+  },
+  "rules": {
+    "unused-dependencies": "warn"
+  }
+}