Add secure local-store lifecycle contract

[andrei-hasna]

Summary

• add hasna.secure_local_store_policy.v1 and @hasna/contracts/secure-local-store
• add dry-run/apply lifecycle planning for owner-only local stores, SQLite sidecars, retention gates, active-record exclusions, artifact allowlists, and safe SQLite maintenance gates
• add CLI, docs, example fixture, tests, and dist smoke coverage

Verification

• bun run verify:release
• staged credential-value pattern count: 0
• staged todos redaction hits: 0
• git diff --cached --check

Blockers / follow-up

• package-wide adoption remains gated on P0/P1 redaction-before-persistence tasks
• each owner package still needs real active-record proof adapters before destructive retention or SQLite maintenance on live stores
• no live local-store cleanup was applied in this PR