[Amosel]

What does this PR do?

Adds repository artifact cleanup for stale node_modules, Rust target, separately risky Node build output, and explicitly opted-in Go bin/dist. Selected artifacts are checked again before deletion or backup, so a preview cannot authorize a replaced, newly tracked, excluded, or recently active candidate.

• Share one request-scoped repository walk with immediate-parent markers, Git index/HEAD protection, positive ignore checks for generic outputs, and descendant keep-path vetoes.
• Add configurable roots/exclusions, immutable scan evidence, selected-path deduplication, equivalent dry-run validation, and backup refusal without permanent-deletion fallback.
• Add versioned clean JSON outcomes, optional item metadata, streaming events/cancellation, and live sorting/search/paging with empty initial selections and a separate final confirmation.
• Integrate desktop deep previews while preserving permanent cleanup and excluding the new categories from scheduled/quick cleanup.

Type of change

• Bug fix
• New feature (new scanner, command, or option)
• Improvement to existing feature
• Chore / dependency update
• Documentation

Related issue

None linked.

Checklist

• bun run lint passes (root and desktop source)
• bun run test:coverage passes: 539 tests across 56 files; all existing coverage thresholds met
• bun run build succeeds
• New tests added for new behavior
• Tested locally on macOS using isolated temporary fixtures
• Root and desktop bun run typecheck pass
• Desktop bun run test passes: 46 tests across 6 files; desktop build succeeds
• Planning validator and git diff --check pass
• Real PTY smoke check covers Enter during scanning and selection retention through sorting/search/paging

Notes for reviewer

Implementation and acceptance evidence are recorded in execution.yaml. The accompanying PRD, decisions, and audit preserve the design rationale and historical findings.

Fixture benchmarks measured approximately 64 ms / 549 ms / 3.63 s for 30 / 300 / 1,500 candidates. Overlapping roots did not duplicate candidate inspection; Git query counts scale with worktree batches. These are single ordered samples with cache/order effects, not production throughput guarantees.

Filesystem/Git validation remains non-atomic, byte counts are logical estimates, and ambiguous generic outputs in non-Git projects intentionally remain ineligible. Cleanup tests touched temporary fixtures only; external-tool cleanup was mocked.