feat(entrypoints): stage-0 framework gate and the unresolved counter (unit 2)

[rahlk]

Problem

Unit 1 (#154) landed the entrypoint contract with an honest-but-empty report: frameworks_detected: []
means "no gate ran", not "no frameworks present". Nothing distinguishes a project with no entrypoints
from a project whose entrypoints the analyzer could not name.

Unit 2 of docs/design/specs/entrypoint-detection.md
(#150), Task 1 of the plan (docs/design/plans/2026-09-03-entrypoints-units-2-5.md).

Scope boundary

The stage-0 framework gate and the unresolved counter. No rules file, no matcher — the gate has
nothing to gate yet except the report. Moves the pass into src/entrypoints/.

Goals

• detectedFrameworks(app, rules): a framework is present if first-party source imports it OR the
  dependency manifest names it; both sides lowercased
• report.frameworks_detected populated
• report.unresolved: every decorator/base spelling neither the import table nor the module can
  name — excluding JS globals, declared types and imported heads
• src/schema/entrypoints.ts moves to src/entrypoints/pipeline.ts

Caveats and known risks

• False positives are worse than misses; the gate is what prevents a locally defined Controller
  from registering later. It is not an optimisation.
• The counter is what makes silence visible. A wrong isSignature classifier shows up as extra
  keys in the counter — the test pins the exact expected map.

Definition of done

• Detection by import and by manifest each covered by a test; case-insensitivity covered
• The unresolved counter's exact contents asserted on a fixture with a builtin, a declared type,
  an imported head and a genuinely unnameable base
• bun test green including the unit-1 contract test