feat(workspace): add cleanup lifecycle (clean, prune, protect, unprotect)

[reckerp]

What

Adds the Workspace Cleanup Lifecycle so worktree-heavy development stays maintainable over time. Workspaces accumulate quickly across reviews, fixes, experiments, and agent tasks, and removing them by hand requires inspecting each one. This lets gx answer which workspaces are old, which are unsafe (local changes), which branches no longer have a worktree, which must never be removed, and shows exactly what will be deleted before anything destructive happens.

New gx workspace subcommands:

• clean — interactive multi-section picker (workspaces, local branches without workspaces, orphan branches whose remote tracking branch is gone). Protected, main, current, and locked rows are shown but disabled with a tag explaining why, so a skipped row never looks like a scanner miss.
• clean --auto — removes every workspace that passes the safety checks, with a single final confirmation. --use-threshold limits it to workspaces older than threshold_days; --dry-run reports without deleting; --force bypasses the dirty/untracked/unpushed checks but never the main, current, locked, or protected guards.
• prune [--dry-run --no-branches] — runs git worktree prune, then deletes safe orphan branches after confirmation.
• protect [branch] / unprotect [branch] — manage the configured protected-branch list, defaulting to the current branch and erroring on detached HEAD.

Safety model

A workspace is safe to remove only when it is not the main worktree, not the current worktree, not locked, not on a protected branch, and has no uncommitted, untracked, or unpushed work. Branches that are always protected regardless of config: the configured default branch, main, master, the current branch, and any branch checked out in an active worktree. Orphan branches with no upstream are treated as unsafe because their commits exist only locally.

Age uses a conservative calculation: the smaller of days since the branch's last commit and days since the workspace .git pointer was last modified, so a fresh workspace created off an old branch is treated as fresh.

Config

[workspace]
protected_branches = ["staging", "release"]

[workspace.clean]
threshold_days = 7
auto = false

All fields default via serde, so existing config files keep loading unchanged.

Implementation

• src/args.rs — new subcommands and flags.
• src/git/worktree.rs — branch listing, unpushed/upstream checks, conservative age calculation, orphan and gone-branch detection, metadata prune.
• src/commands/workspace_clean.rs — command handlers; pure safety and prune-eligibility logic.
• src/ui/clean_picker.rs — multi-section picker reusing the background summary lookup and stderr terminal setup.
• src/config.rs — [workspace.clean] table, protected_branches, and config::store.

Reuses ui::confirm, the existing summary lookup, terminal helpers, and the config loader. All human-readable output goes to stderr; stdout stays reserved for shell navigation (the clean handler emits a navigation target only when the current workspace is removed).

Testing

cargo build and cargo test both pass (162 tests). New unit tests cover: main worktree never removed (even with --force), current worktree never removed, dirty/untracked/unpushed skipped without --force, locked skipped, protected branch skipped, orphan branch deletion gated on safety + confirmation, orphan with no upstream treated as unsafe, fresh workspace off an old branch not stale, gone-branch parsing, and the picker's row/section/selection logic.