Improve detection of unused code beyond SpotBugs

### User Story

As a developer of Sleeper, I want better tooling to detect unused code, so that we can keep the codebase clean and avoid maintaining dead code.

### Description / Background

SpotBugs catches unused private methods, unread fields, and dead local stores, but cannot detect unused public/protected methods, unused classes, or cross-module dead code. This is how RowSerialiser and Base64ResultsBatchSerialiser (#7190) went unnoticed.

We should investigate tools that can do whole-project reachability analysis to cover these gaps.

### Acceptance Criteria

**Given** a class or method has no production callers across the project
**When** the CI pipeline runs static analysis
**Then** the unused code is flagged

### Technical Notes / Implementation Details

Need to look into options...

### Dependencies / Blockers

None

Start by reviewing the existing SpotBugs coverage and the CI pipeline that runs static analysis. Compare whole-project reachability options against the gaps described for public and protected methods, unused classes, and cross-module code. Done means selecting an approach that flags unused production code in CI and documenting the required integration.

Written by the indexing model from the issue text.