feat: add cleanup subcommand to reap stale copies on hosts

[jfding]

Summary

Adds a git-supervisor cleanup subcommand that reaps the stale
*.to-be-removed copy
directories which check-push.sh moves aside but never deletes (the rm -rf
was
deliberately deferred), so they accumulate indefinitely on controlled hosts.
status
already surfaces these; this command finishes the deletion.

• Dry-run by default — lists what would be removed and deletes nothing.
  --apply deletes.
• --host <glob> — same scoping semantics as status (repeatable,
  union).
• Dedicated embedded cleanup_probe.sh runs once per host: enumerates
  *.to-be-removed dirs,
  emits a fixed 6-column TSV, and (only with APPLY=1) deletes each itself
  via a safe-rm guard
  ported from check-push.sh — refuses the copies root and anything not
  resolving strictly
  under <dir_base>/copies/ (incl. symlinks escaping the tree).
• Parallel fanout across hosts; status-style age-annotated output; best-effort
  with aggregate
  non-zero exit if any host or deletion fails.
• Scope is intentionally *.to-be-removed only — not unknown dirs, not
  active reaping.

Test Plan

• cargo test — 97 passed, 2 ignored
• cargo clippy — no issues
• bash core/tests/scripts/test-cleanup-probe.sh — 0 failures (incl.
  safe-rm out-of-tree refusal)
• Integration tests vs localhost: dry-run lists w/o deleting; --apply
  deletes only stale,
  spares live copies; --host no-match errors; empty host → "(nothing to
  clean)"; --apply
  refuses out-of-tree symlink and exits non-zero
• Manual smoke against a real remote host