API surface: decide what the DSL means, remove dead code

Before a 1.0 the public surface has to be intentional.

• ~20 of 48 AgentBuilder.withX() methods set fields nothing reads. 21 of Agents ~50 getters have no read sites outside dsl/ — including every memory, storage, vector, guardrail, MCP, embedding, context and task-list option. The sharpest case: the headline example in CLAUDE.md uses four methods that nothing in the repo reads or tests. Silent no-ops in a public API are the worst of the three options — wire them, delete them, or make them throw.
• dsl/ has no test directory at all, covering the two largest files in the repo.
• Seven overlapping agent-execution paths, including two public classes both named AgentExecutionFunction. The best-designed path has zero production call sites; the de-facto real one has no Flink state and parses tool calls with a hand-rolled string-splitting parser while Jackson is already on the classpath.
• ~2,600 LOC unreachable (CEP pattern builders, a duplicate memory lineage, a 260-line store interface with no impls, several orphaned functions). Saga compensation is emitted to a side output that nothing consumes, so rollback never runs.
• Dead root-level files: sql/schema.sql defines five tables no code references and is mounted as a Postgres initdb script; config/*.yaml describe a config format with no loader; run-demo.sh is a pre-rename relic.
• 396 of 403 public types are public with no @Public/@Internal markers, and there are zero @Deprecated annotations despite a documented deprecated path.

Roadmap epic. Detailed findings, file:line citations and sub-tasks live in the AI-grind tracker (project AGS), which is the source of truth for this work. Local dev — build, test, tracking, profiling — is managed with AI-grind.

Tracked as AGS-7 in the devtools-mcp tracker.

Start with the AGS-7 tracker for the detailed findings and sub-tasks, then inspect the two largest files under dsl/ and the public AgentBuilder and Agent APIs. Use AI-grind for the local build and tests; this work is done only when the public surface, execution paths, dead code, and missing coverage have been intentionally resolved.