cairn: add CULL sweep (cull-candidates + eviction)

[quad341]

Summary

cairn cull-candidates reports entries that haven't been recalled in a while (default 30-day disuse threshold), independent of the existing freshness/anchor-drift check. Pairing it, a new evict path retires those entries: private (agent:-scope) entries are deleted directly, the same way other private mutations already commit straight to main; shared entries (role:/rig:/global: scope) are never deleted directly — evicting one only opens a review-branch proposal that a reviewer has to merge.

Why built this way

Shared-tier entries are collectively owned, so a silent direct delete there is a materially bigger risk than deleting a private note. The scope-conditional guard in the evict path is a hard invariant, not a configurable default — there's no flag that lets a shared-tier entry bypass the review-branch proposal.

Review notes

• New CLI surface in cmd/cull.go: cairn cull-candidates (report) and cairn cull evict.
• Core logic: internal/cairn/cull.go (candidate detection) and internal/cairn/evict.go (EvictDirect vs EvictToReviewBranch, gated by scope).
• Role-tier (role:) entries are untouched by this feature — they keep their existing "light self-curation" policy.
• A pinned opt-out tag is deliberately not included in this pass — a reviewer can already reject any individual entry out of a shared-tier cull proposal, which covers "keep this one" for now.

Bead

crn-whno — CULL sweep (cull-candidates + eviction), source review crn-28ge.1.7

Test plan

• go build / go vet / gofmt / golangci-lint (cache-cleaned) all clean; go test ./... -race -count=1 — 5 packages, zero regressions
• Negative test confirms shared-tier entries (rig/role/global scope) can never be direct-deleted, only proposed via a review branch
• Release gate: release-gates/cairn-cull-sweep-gate.md