feat: add backup retention and local observability

[1074016045]

Summary

Completes the final v0.6 increment with:

• explicit SQLite backup-pair retention
• dry-run by default and confirmed apply mode
• deterministic manifest-createdAt retention policy
• ownership-pinned deletion and handled-failure rollback
• fail-closed recovery residue
• content-free local maintenance events on stderr
• read-only local operations-status CLI
• v0.6 documentation and roadmap completion

Retention behavior

A valid backup pair is eligible only when:

1. its manifest createdAt is strictly older than the configured maximum age
2. it is outside the newest configured keepLatest valid pairs

Retention never runs automatically.

Apply requires both --apply and --confirm-delete.

Invalid, incomplete, unknown, symlinked, temporary, WAL/SHM, lock, and recovery artifacts are never deleted.

Safety

Retention apply uses:

• an exclusive owned operation lock
• O_NOFOLLOW where supported
• retained ownership handles
• path-identity checks before mutation
• same-directory recovery hard links
• replacement-preserving rollback
• recovery residue that blocks subsequent automatic runs

The protocol handles ordinary failures conservatively but does not claim crash atomicity across process death, power loss, or host failure.

Operational observability

Maintenance commands emit closed-schema NDJSON events on stderr.

Events contain only bounded operational fields such as:

• operation and outcome
• safe error codes
• durations
• counts
• byte totals

They exclude paths, filenames, backup names, hashes, identifiers, SQL, user content, credentials, causes, and stacks.

No telemetry, analytics, log shipping, persistent operational logging, or external request is added.

Operations status

Adds the following commands:

• pnpm --silent ops:status
• pnpm --silent ops:status -- --json

The command performs a local, read-only inspection of:

• SQLite integrity and migration state
• backup inventory counts
• transcription-job state counts
• expired running jobs
• pending deletion batches
• retention configuration

It performs no migration, database creation, cleanup, enqueueing, lease recovery, or network request.

Commands added

• pnpm --silent db:backup:retention -- --dry-run
• pnpm --silent db:backup:retention -- --apply --confirm-delete
• pnpm --silent ops:status
• pnpm --silent ops:status -- --json

Verification

• focused retention/observability suite passed five consecutive runs
• 530 Vitest tests passed
• lint passed
• typecheck passed
• boundary evaluation passed
• understanding evaluation passed
• Playwright: 6/6 passed
• production build passed
• targeted formatting passed
• git diff --check passed

Scope

No changes to:

• dependencies or pnpm-lock.yaml
• database schema
• migrations
• Transcript Lab E2E retries
• package version
• web APIs or UI

No tag or release is created by this PR.