fix(dev-server): don't clobber a caller-set authz catalog; drop dead RuntimeDeps.authz

createProductionHandlers called setAuthzCatalog unconditionally, so a caller
using client.ts's documented escape hatch (setAuthzCatalog(catalog) before
importing anything that reads it) had that catalog silently wiped to empty
whenever opts.authz was omitted. Now only sets when opts.authz has entries to
contribute, or when nothing has been set yet; a non-empty opts.authz still
always sets and still throws on a genuine conflict.

Also removes RuntimeDeps.authz: nothing read it, and its doc comment
described a consumer that doesn't exist. The real wiring is
getAuthzCatalog()/setAuthzCatalog(), including the HMR hot-update path, which
is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/dev-server/src/index.ts

@@ -472,7 +472,6 @@ export async function startServer(opts: ServeOptions): Promise<RunningServer> {
     security: opts.security,
     observability: opts.observability,
     tenancy: opts.tenancy,
-    authz: authzCatalog,
     navigation: opts.navigation,
     clientRuntimes: pluginContributions.clientRuntimes,
     hub,
@@ -636,7 +635,6 @@ export async function startServer(opts: ServeOptions): Promise<RunningServer> {
             (file) => loadModule(file) as Promise<{ default?: AuthzModule }>,
           );
           setAuthzCatalog(nextAuthzCatalog);
-          runtimeDeps.authz = nextAuthzCatalog;
         } catch (error) {
           console.error(
             "[wrnexus] authz hot update failed — the PREVIOUS catalog remains authoritative " +