feat(storage): consolidate lifecycle safeguards

[luoye520ww]

Problem

Storage-related capabilities were split across three small branches, making review noisy and leaving the usage scanner without a root symlink boundary.

Root cause

The usage scanner used lstat for child entries but opened the configured root directly. A symlink or junction supplied as the root could therefore be followed before the safety check.

Scope

This PR consolidates the storage usage report, safe cleanup policy, and data-retention contract into one reviewable storage-lifecycle change. It does not delete data, add UI, or perform migrations.

Changes

• Add bounded per-category storage usage scanning with missing-root and error reporting.
• Refuse to follow symlink/junction roots or child entries.
• Add pure cleanup decisions protecting active threads, unmerged worktrees, pinned checkpoints, and recent rescue snapshots.
• Add validated retention categories and fail-closed age checks.
• Add regression coverage for root symlinks, budgets, malformed candidates, and unsafe retention inputs.

Safety

• Read-only scanner; no deletion side effects.
• Per-category entry budget prevents unbounded traversal.
• lstat is used before opening roots and child entries.
• Invalid timestamps and retention policies retain data rather than deleting it.
• Cleanup policy returns a decision only; a future deletion service must re-check paths and races.

Typecheck

• npm.cmd run typecheck
• npm.cmd --prefix kun run typecheck

Both passed.

Tests

• npm.cmd exec vitest run src/main/services/storage-usage-report.test.ts src/main/services/storage-cleanup-policy.test.ts src/shared/data-retention.test.ts
• 3 files, 16 tests passed.

Actual validation

Used real temporary directories and files, including a symlink root, nested files, missing roots, and bounded traversal. The scanner remained read-only and did not traverse the linked target.

Review performed

• Functional correctness
• Concurrency/lifecycle and bounded traversal
• Data integrity and fail-closed retention
• Symlink/path safety
• Cross-platform filesystem behavior
• Performance bounds
• Test quality and PR scope

PR size

• Production files: 3
• Test files: 3
• Production LOC: 330
• Total diff: 501 added lines

Non-goals

Automatic cleanup, retention UI, backup integration, and database repair remain separate follow-ups.

Supersedes

• feat(storage): add bounded storage usage report #917
• feat(storage): define safe cleanup policy #918
• feat(storage): define data retention contract #928

[luoye520ww]

Superseded by #941, which now contains the same storage lifecycle safeguards together with the validated packaging/CI smoke fix. Closing this duplicate to keep review scope consolidated.

[luoye520ww]

Superseded by #941.