feat: add reviewable cleanup plans

[svg153]

Closes #117.

Summary

• Add explicit versioned cleanup plans with --export-plan and clean --plan.
• Keep the plan flow non-destructive by default and require --dry-run or --yes.
• Validate schema, action, root identity, traversal boundaries, category, type, size, and modification time before applying a plan.
• Abort the complete plan when any candidate is missing or changed.
• Add CLI, manifest, filesystem, and documentation coverage.

Safety

Review-only findings are not included in plans. Plans are written with owner-only permissions and contain real filesystem paths, so the documentation warns users not to share them publicly.