Converge retained WIP and harden evidence boundaries (#1065)

Summary:
- lands the audited current WIP lanes and excludes stale/process-only
material
- hardens prune path confinement, probe-v3 evidence binding,
codebase-recon identity, handoff/release/reverse-engineer behavior, and
Codex prompt handling
- truth-labels static skill scoring and regenerates all owning
projections

Validation:
- fresh independent PASS on commit
427098ed10
- full Go suite and full Go race suite
- quick local release CI
- focused Bats, scenario/linkage, native-skill, reverse-engineer,
Cathedral, Ruff, Python ratchet, projection, and diff checks

Residual boundaries:
- final-basename ABA remains unclaimed
- live skill-probe coverage remains honestly 0/12
- release-only cross-build, SBOM, vulnerability, and release-evidence
checks are left to delivery CI

cli/docs/COMMANDS.md

@@ -880,7 +880,7 @@ ao goals scenarios [flags]
 
 ### `ao session`
 
-Inspect or export session evidence
+Inspect session evidence and maintain .agents artifacts
 
 ```
 ao session [command]
@@ -921,6 +921,22 @@ ao session handoff [summary] [flags]
   -h, --help                  help for handoff
 ```
 
+#### `ao session prune-agents`
+
+Apply .agents retention policies (dry-run by default)
+
+```
+ao session prune-agents [flags]
+```
+
+**Flags:**
+
+```
+      --execute   Delete the selected artifacts; the default is a read-only dry run
+  -h, --help      help for prune-agents
+      --quiet     Suppress per-path output and print only the summary
+```
+
 #### `ao session rehydrate`
 
 Read a handoff without consuming it, claiming work, or choosing a next action.