Configure Knip source discovery

[SybelBlue]

Summary

• anchor the Python packaging /lib/ ignore rule so nested frontend sources remain visible to Knip
• configure root and sketch_tool workspace entry points and project files
• point Knip at the nonstandard Webpack config filenames and account for HTML- and runtime-loaded JavaScript
• ignore the buffer package false positive caused by its Node built-in name

Testing

• git diff --check master...HEAD
• npm exec --yes --package=knip@6.38.0 -- knip --include files --no-exit-code --no-progress
  • reports the two existing cleanup candidates: lib/config-validator.js and postcss.config.js

PostCSS cleanup is intentionally out of scope and will be handled separately.