feat(run): resume-aware per-check runs, verify hooks, run-state hardening

/pygienium-<check> is now resume-aware (terminal checks skipped unless
--fresh) and shares run-state with all/resume; every check gets a verify
hook that fails loudly when a sub-agent returns ok with no artifact;
run-state clears stale errors on retry success and reconciles a run as
failed only when every check failed. Drops the superseded
hygiene-state.ts model.

src/checks/dead-code.ts

@@ -1104,6 +1104,31 @@ export async function deadCodeGate(cwd: string): Promise<string | undefined> {
 	return undefined;
 }
 
+/**
+ * Verify hook: confirms the check actually produced its artifacts (mirrors
+ * {@link commentsVerify} / {@link todosVerify}). After scan `findings.md`
+ * must exist; after `--fix` `changes.md` must exist too. Catches a sub-agent
+ * that returns ok with no output — which would otherwise be a false
+ * `complete`.
+ */
+async function deadCodeVerify(scope: CheckScope): Promise<string | undefined> {
+	const f = findingsPath(scope.target);
+	try {
+		await stat(f);
+	} catch {
+		return `dead-code verify: expected findings.md at ${f} after scan, none found.`;
+	}
+	if (scope.fix) {
+		const c = changesPath(scope.target);
+		try {
+			await stat(c);
+		} catch {
+			return `dead-code verify: expected changes.md at ${c} after --fix, none found.`;
+		}
+	}
+	return undefined;
+}
+
 /** The registered `CheckDefinition` (module self-registers on import). */
 export const deadCodeCheck: CheckDefinition = {
 	name: "dead-code",
@@ -1116,6 +1141,7 @@ export const deadCodeCheck: CheckDefinition = {
 	buildScanTask: buildDeadCodeScanTask,
 	buildFixTask: buildDeadCodeFixTask,
 	gate: deadCodeGate,
+	verify: deadCodeVerify,
 };
 
 // Self-register so `index.ts` auto-discovers this check with zero wiring edits.