fix(storage): batch retired Session artifact cleanup

[99Gaoxiaoqi]

Summary

Retiring M Sessions previously performed M serialized full-store Artifact path scans. Resolve one locked Artifact snapshot per retirement batch, retain the bounded resolver concurrency, and commit the successful Sessions' metadata deletions in one transaction.

Keep per-Session unlink and directory-sync failures independent: successful siblings can finish, while failed Sessions retain their existing retirement cleanup obligations for retry. A global guard-resolution or metadata-commit failure prevents the batch from reporting success. Cross-Session aliases remain protected, including aliases between two Sessions in the same retiring batch. The single-Session purge API delegates to the batch implementation.

Fixes #4038

Verification

• npm run build — passed.
• npm run typecheck — passed across all workspaces.
• npm run lint and npm run format:check — passed.
• npx knip --workspace apps/desktop and npx knip --workspace packages/ui — passed.
• npm --workspace @maka/storage run test:dist — 1,207 passed, 8 skipped, 0 failed.
• Focused Host retirement/execution-artifact tests — 32 passed.
• Host Artifact coordinator, two-client Session revision, and storage maintenance tests — 9 passed.
• Serial-control experiment: restored the original per-Session scan behavior behind the batch API; the scan-count regression failed as expected. The batch implementation resolves each retained payload once for eight retiring Sessions.
• Crash regressions kill a child process after unlink and after metadata commit, then reopen and retry. Fault injection also covers partial unlink, directory sync, metadata rollback, alias guards, and Host pending-cleanup settlement.
• git diff --check — passed.

No live Desktop E2E or cross-platform run was performed; this change affects storage and Host cleanup without changing the UI. Validation ran on macOS with Node 26.7.0 and npm 11.19.0.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex integrated the existing local implementation with current main, documented the batch recovery contract, reviewed the deletion/recovery paths, and performed build, regression, fault-injection, and control-experiment validation. This draft is submitted by Codex on behalf of @99Gaoxiaoqi for human review.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No