Add safe CAS garbage collection and retention-aware mark and sweep

[haasonsaas]

Context

A longitudinal executable corpus can grow indefinitely, while derived rows, legal holds, and incomplete uploads make blind deletion unsafe. Retention needs a recoverable, auditable storage lifecycle.

Proposal

Add a dry-run and execute garbage collector that marks live CAS objects from artifact records, active jobs, analysis receipts, and legal holds; sweeps only unreferenced objects after a grace period; and records counts/digests.

Acceptance criteria

• Dry-run reports candidates without mutating storage.
• Active analysis jobs, legal holds, and failed-but-retryable uploads protect their inputs.
• Sweep is resumable and idempotent after interruption.
• Every deletion records tenant, digest, reason, actor, and timestamp.

References

• content-addressed store
• artifact retention/lineage model