Summary

Add the missing bounded lifecycle for local telemetry archives:

• maple archive retire-live <range-date> --apply removes one verified UTC day from the six live raw tables.
• maple archive expire <range-date> --apply removes one complete archived UTC day across all six signals.
• Both operations hold the existing maintenance lock, persist resumable progress journals, freeze archive-generation evidence, and fail closed when observed state changes.
• maple start --raw-telemetry-retention-days <days> provides an explicit opt-in TTL backstop for operators whose coordinated active-data window exceeds Maple's normal schema TTLs. Omitting the flag preserves current defaults.
• Live retirement re-hashes the target generation's Parquet shards before any live partition is dropped.

Why

The archive work merged in #194 provides checkpointing, validated archive generation, reconciliation, verification, and garbage collection, but no coordinated operation for retiring verified live partitions or expiring complete archive days. Operators therefore cannot bound both the active store and archive volume using Maple's durable archive protocol.

An earlier local implementation also changed every user's raw-table TTL to 120 days during startup. This version removes that global behavior and makes the TTL override explicit and optional.

Safety and recovery

• Both destructive commands refuse to run without --apply.
• A complete active generation is required for every signal.
• Live counts must match frozen archived counts before retirement begins and before each remaining partition drop.
• Target archive shards are size-checked and SHA-256 verified before live deletion.
• Generation IDs are frozen in the durable journal; supersession after intent fails closed.
• Interrupted operations resume the exact journaled day and completed signal prefix.
• Archive expiration tombstone-renames each range before removal and rebuilds its catalog before advancing progress.

Validation

• bun run --filter @maple/cli typecheck
• 21 focused retention, TTL, and detached-server argument tests passed.
• Full CLI run: 398 tests passed in the sandbox; its three ephemeral listener-bind tests were sandbox-blocked and then passed with normal host networking (10/10 in server-network.test.ts).
• Branch is based directly on upstream main at 6578edf1.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}