cleanup

Run the cleanup audit to inventory branches, worktrees, and jj workspaces with merged status, unpushed commits, and dirty-state checks. It recommends removal only for merged or content-equivalent targets and requires explicit per-target approval plus a verified backup before deleting anything.

Completed work directories under the resolved state root are moved to a permanent `.state/archive/` location rather than deleted, after all retirement gates pass. A timestamped backup with restoration metadata is created first, and the archive prevents retired work IDs from being reused.

Yes, missing gh CLI, network, or credentials does not abort the local inventory. Remote evidence is marked partial or stale, affected recommendations are downgraded, and the --exclude-remote flag skips remote fetches and PR checks entirely.

Archival is refused when required tasks are unfinished, reviews have outstanding findings, promotion receipts are missing, a named blocker or open question remains, or fewer than three days have passed since landing evidence. Ambiguous or contradictory state is always preserved.

The audit never scans unregistered directories, never infers approval from the /cleanup invocation, and never performs history rewriting or dead-code removal. Age alone or a merged branch never authorizes state archival; every destructive action needs separate explicit approval.