Drop the removed-features regression test

[16francej]

Removes test/removed-features.test.ts.

The suite pinned a hand-maintained list of retired paths, forbidden substrings and dead endpoints. It grew with every deletion, forced new work to launder strings through join() so ordinary prose would not trip the scanner, and mostly restated history that git already records.

The second commit ports the one assertion worth keeping: a capability token whose aud does not match the route gets a 403. It now sits in test/capability-routes.test.ts alongside the other capability rejection paths (expired, wrong owner, non-self-service route).

What goes away with the file, honestly stated:

• the path and substring sentinels for retired subsystems — deliberate, that is the point of the PR
• 404 assertions for nine retired endpoints (Wallet pairing, credential bootstrap/revoke/list, keychain import, webhooks, Gmail watches) — the routes do not exist, so 404 is the default, not a behaviour worth pinning
• one real gap: an end-to-end check that a stale .config/agent/credentials.env never beats Keychain — rotation takes effect, deletion yields unset. test/keychain.test.ts covers upsert, rotation and revocation at the store level but not that precedence through a turn. Happy to port it if we want it kept.

No other file references the deleted test, npm run test:root:shard:check still enumerates every root test exactly once, and every symbol the deleted file imported still has other callers, so knip stays quiet.