ci: add Knip dependency check

Add a dependency-only Knip CI shard, keep full unused-file mode manual, and scope pnpm's release-age override to the latest Knip dlx install.

.github/workflows/ci.yml

@@ -1199,6 +1199,9 @@ jobs:
           - check_name: check-lint
             task: lint
             runner: blacksmith-16vcpu-ubuntu-2404
+          - check_name: check-dependencies
+            task: dependencies
+            runner: ubuntu-24.04
           - check_name: check-policy-guards
             task: policy-guards
             runner: ubuntu-24.04
@@ -1281,6 +1284,9 @@ jobs:
             lint)
               pnpm lint --threads=8
               ;;
+            dependencies)
+              pnpm deadcode:dependencies
+              ;;
             policy-guards)
               pnpm lint:webhook:no-low-level-body-read
               pnpm lint:auth:no-pairing-store-group