add unreachable_pub lint, fix all 17 violations

pub → pub(crate) for SseReader methods (used across child modules).
pub → pub(super) for openai::stream_events, tool definitions, store
helpers. pub → private for normalize_link and differentiate_hub_with_graph
(only used within their own files).

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/agent/api/openai.rs

@@ -15,7 +15,7 @@ use super::StreamEvent;
 /// Stream SSE events from an OpenAI-compatible endpoint, sending
 /// parsed StreamEvents through the channel. The caller (runner)
 /// handles routing to the UI.
-pub async fn stream_events(
+pub(super) async fn stream_events(
     client: &Client,
     base_url: &str,
     api_key: &str,