feat: add run-owned cleanup receipts

[danielgwilson]

Summary

• add optional run-owned provider resource records to run bundles
• add mimetic cleanup --run <id> to reclaim only exact resources recorded in that run and write cleanup.json
• teach verify to report cleanup receipt status and keep old bundles passing when cleanup was not requested
• record E2B CUA sandbox resources from live CUA bundles without adding adopter-specific nouns

Safety

• cleanup is exact-id only; it does not enumerate or bulk-delete provider accounts
• persisted cleanup receipts use [target-cwd], matching public-safe run bundle behavior
• existing dry runs and in-process/local lanes emit no provider resources

Verification

• pnpm vitest run tests/run.test.ts
• pnpm typecheck
• pnpm build
• pnpm check
• pnpm public-surface:scan
• pnpm release:check