chore(cli/org): silence dead_code on not-yet-consumed attachment API

crates/relicario-cli/src/org_session.rs

@@ -17,6 +17,10 @@ use relicario_core::{
 /// so this mirrors the personal-vault default
 /// `AttachmentCaps::per_attachment_max_bytes` at
 /// crates/relicario-core/src/settings.rs:116.
+// Attachment API — consumed by `org add document`, Document edit, and purge
+// landing in Tasks C2/C3; `load_attachment` additionally backs a future
+// org document read/extract. Allow dead_code until those consumers land.
+#[allow(dead_code)]
 pub const DEFAULT_ORG_ATTACHMENT_MAX_BYTES: u64 = 10 * 1024 * 1024;
 
 pub struct UnlockedOrgVault {
@@ -122,12 +126,14 @@ impl UnlockedOrgVault {
         }
     }
 
+    #[allow(dead_code)]
     pub fn attachment_path(&self, collection_slug: &str, item_id: &ItemId, att_id: &AttachmentId) -> PathBuf {
         self.root.join("attachments").join(collection_slug)
             .join(item_id.as_str()).join(format!("{}.enc", att_id.as_str()))
     }
 
     /// Encrypt-already-done blob: persist it and return the repo-relative path for git staging.
+    #[allow(dead_code)]
     pub fn save_attachment(&self, collection_slug: &str, item_id: &ItemId, enc: &EncryptedAttachment) -> Result<String> {
         let path = self.attachment_path(collection_slug, item_id, &enc.id);
         if let Some(parent) = path.parent() {
@@ -137,6 +143,7 @@ impl UnlockedOrgVault {
         Ok(format!("attachments/{}/{}/{}.enc", collection_slug, item_id.as_str(), enc.id.as_str()))
     }
 
+    #[allow(dead_code)]
     pub fn load_attachment(&self, collection_slug: &str, item_id: &ItemId, att_id: &AttachmentId) -> Result<Zeroizing<Vec<u8>>> {
         let path = self.attachment_path(collection_slug, item_id, att_id);
         let bytes = fs::read(&path).with_context(|| format!("read attachment {}", path.display()))?;
@@ -145,6 +152,7 @@ impl UnlockedOrgVault {
 
     /// Remove an item's whole attachment directory. Missing dir is NOT an error
     /// (mirrors `remove_item`'s NotFound-tolerant behavior, for partial-write recovery).
+    #[allow(dead_code)]
     pub fn remove_item_attachments(&self, collection_slug: &str, item_id: &ItemId) -> Result<()> {
         let dir = self.root.join("attachments").join(collection_slug).join(item_id.as_str());
         match fs::remove_dir_all(&dir) {