refactor(cli): sweep vex_consumed.rs and vex_sources.rs (#1948)

* Start sweep of vex_consumed.rs and vex_sources.rs

Assisted-by: Claude Code:claude-opus-5-5

* Sweep vex_consumed.rs and vex_sources.rs

vex_consumed.rs: drop the not_installed() wrapper and the cfg(test)
npm_identity_fallback forwarder (the reusing variant takes its name),
drop banner and bare issue-ref comments, fix the stale and garbled
test docs, and drop the write_pkg test wrapper. The two
npm_alias_copies_* tests exercise ecosystem_dispatch's every-copy
lookup, so they move there.

vex_sources.rs: inline fetch_concurrency, recognized_dead_note and
build_candidates, drop the note() forwarder for PlanNote literals,
make the module-only NOTE_* consts private and group the unattested
ones together, and drop banners and bare issue refs. The deleted
fetch_concurrency test only re-checked core's api_concurrency.

No behavior change.

Assisted-by: Claude Code:claude-opus-5-5

* Keep two named helpers; tidy moved tests

/code-review: fetch_concurrency's test is the only check of this
window's own FETCH_CONCURRENCY ceiling, and build_candidates names a
step plan() is better off without inlined, so both stay. The moved
ecosystem_dispatch tests are renamed after the lookup they test, call
it directly, keep the "no second alias walk" reason, and share the
package.json writer with write_npm_package.

Assisted-by: Claude Code:claude-opus-5-5

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: mikolalysenko