fix(cleanup): reclaim superseded index files promptly

[lance-gatefixer]

Summary

• scan all managed index artifacts while manifest-derived UUID verification is still available
• preserve referenced and recent-unverified index safety checks
• add a multi-fragment regression test for short-retention cleanup

Root cause

Cleanup limited every managed subtree to files no newer than the earliest retained manifest. When that cutoff skipped a newer artifact under a superseded index UUID, the same cleanup pass could delete the old manifest that proved the UUID was committed. Later passes then treated the artifact as unverified and retained it for seven days.

Fix

Index cleanup now inspects the full managed index subtree. Referenced UUIDs remain protected, recent UUIDs with no manifest evidence remain protected, and superseded UUIDs verified by manifests scheduled for removal are reclaimed before that evidence disappears.

Validation

• cargo test -p lance cleanup_recent_replaced_index_with_short_retention
• cargo test -p lance dataset::cleanup::tests::cleanup_ (20 passed)
• cargo fmt --all
• cargo clippy --all --tests --benches -- -D warnings

Fixes #8321

[lance-gatekeeper]

✅ Gate recommendation: approve.

The index subtree is now classified while removable manifests can still verify superseded UUIDs, while referenced and recent unknown UUIDs retain their existing protections. Since timestamp filtering happens after recursive listing, this fixes the retention leak without adding object-store listing requests.