fix(storage): verify Space ownership before deletion

[Rio Yu (rioyu123)]

Summary

• resolve destructive blob cleanup from a fresh disk ownership scan
• keep missing-id cleanup limited to an unowned .artifacts directory
• require a matching space.json before recursively deleting a Space directory
• protect alias collisions, Workspace-owned directories, and symlinked scope roots
• release deletion admission when post-acquire validation fails

An absent stable id previously fell back to a literal directory name. If that name matched another Space's title-derived directory, the blob-first sweep and CanvasStore.destroy() could remove that Space even though its stable id was different. The same fallback could target setting/.

The normal read/write fallback remains unchanged. Only destructive resolution is ownership-aware, so legitimate stable-id deletion and cleanup of genuine orphan blobs keep their existing behavior.

Testing

• storage module suite: 255 passed, 2 skipped
• focused deletion/disk suite: 84 passed, 1 skipped
• @huabu/server typecheck
• ESLint on changed TypeScript files (no errors)

Closes #90