feat(storage): define safe cleanup policy

[luoye520ww]

Problem

Storage cleanup needs an explicit fail-closed policy before any deletion service or UI can be added.

Scope

This PR only defines and tests a pure candidate decision function. It does not scan the filesystem, delete files, add IPC, or add UI.

Changes

• Protect active threads, unmerged worktrees, pinned checkpoints, and recent rescue snapshots.
• Apply a per-category minimum age with deterministic override support.
• Reject unknown fields, malformed values, future timestamps, invalid calendar dates, and non-UTC timestamps.
• Keep path resolution and race checks outside the policy so deletion remains a separate safety boundary.

Validation

pm.cmd exec vitest run src/main/services/storage-cleanup-policy.test.ts (3 passed)

pm.cmd run typecheck (passed)

pm.cmd --prefix kun run typecheck (passed)

pm.cmd run lint (passed)

pm.cmd run build (passed)

• git diff --check (passed)

Review

Completed functional, lifecycle, data integrity, security, cross-platform, performance, compatibility, test quality, and scope review. The policy is pure and performs no filesystem operations.

Follow-ups

A separate cleanup service must revalidate canonical paths and candidate state immediately before deletion.

[luoye520ww]

Superseded by #944, which consolidates storage usage reporting, safe cleanup decisions, and data-retention validation into one reviewed PR. Closing this split PR to avoid duplicate review.

[luoye520ww]

Closed in favor of #944.