fix(anolisa): fail forget dry-run on adapters

[zyw02]

Why

anolisa forget --dry-run skipped the adapter-claim guard that a real forget enforces. A preview could print a successful "would forget" payload while anolisa forget then exits 2 and asks for adapter disable. The pending-journal check in the same function already previews execute refusals, and uninstall --dry-run already refuses enabled adapters. Dry-run must not tell the operator to proceed when the real drop cannot.

What changed

• Dry-run adapter guard: handle always calls ensure_no_adapter_claims before the dry-run success payload. Execute still re-checks under the lock in persist_forget.
• Adjacent refusals: dry-run with an enabled receipt on the target fails like execute (INVALID_ARGUMENT, exit 2, adapter disable + framework name). A receipt on a different component still previews successfully and leaves both records.
• Regression tests: unit coverage in forget.rs plus subprocess tests/forget_dry_run_adapter.rs (--install-mode system --prefix) so host state cannot change the envelope.

Related issue

fixes #2761

User / Agent impact

anolisa forget --dry-run <component> now refuses when that component still has enabled adapters, matching the real command and uninstall --dry-run. Unrelated receipts and the no-claim dry-run preview are unchanged. JSON error envelopes keep the existing schema and exit 2.

Risk and compatibility

• Public CLI, API, configuration, or documented behavior changed
• Privileged or security-sensitive behavior changed
• Cross-component contract changed
• Migration or rollback guidance is needed

Dry-run success for a claimed component becomes a refusal. Callers that treated the previous false-green preview as authorization will now see the same error execute already returned. Execute behavior, pending-journal dry-run, and no-claim dry-run are unchanged.

Validation

cd src/anolisa
cargo fmt --all -- --check
cargo clippy --all-targets --locked -- -D warnings
cargo test --locked --workspace --lib --bins
cargo test --locked --package anolisa-cli --test forget_dry_run_adapter
cargo test --locked --package anolisa-cli --test uninstall_dry_run_json

Environment: Linux. Head e3de2cb99b88508e6e58edcf5f0c88aa9e9c567f on base 271bd99a43b7049d7eb32199658e7345ca7caadc. Focused tests cover execute refusal, dry-run refusal, unrelated-claim dry-run success, and the JSON envelope pair. Full cargo test --locked as root still hits pre-existing --install-mode user integration failures unrelated to this change.

Documentation and rollback

No documentation change: dry-run is already a preview of the mutation, and the adapter guard comment already described this check as the dry-run preview. Revert this PR to restore the previous false-green forget --dry-run when adapters are enabled.

[kongche-jbw]

Review baseline: 271bd99a43b7049d7eb32199658e7345ca7caadc...e3de2cb99b88508e6e58edcf5f0c88aa9e9c567f

[P1] 让 subprocess 用例脱离 root 身份依赖

src/anolisa/crates/anolisa-cli/tests/forget_dry_run_adapter.rs:194 的 real 调用固定使用
--install-mode system。在非 root 环境中，它会在全局参数校验阶段先返回
PERMISSION_DENIED/exit 5，随后在第 157 行失败，无法得到预期的 adapter
INVALID_ARGUMENT/exit 2。我在 uid 1002 下运行该 integration target 可稳定复现，
因此测试结果取决于 runner 身份。

Possible direction: subprocess 只验证无需 root 的 dry-run envelope，并由现有
in-process execute 用例覆盖 real guard；或让 fixture 在 root/non-root 下均使用合法、
等价的执行模式，并补充非 root 回归。