Expose a safe streamed dry-run prune inspection

[flyingrobots]

Outcome

Callers can inspect which loose unreachable Git objects are past a supplied expiry cutoff without admitting any destructive prune command.

Scope

• Add a first-class streamed plumbing operation that always invokes git prune --dry-run --verbose --no-progress --expire=<time>.
• Validate the expiry argument before process execution.
• Keep unrestricted git prune rejected by the generic command surface.
• Preserve bounded residency through GitStream.
• Cover allowed dry-run execution, output streaming, malformed expiry rejection, and destructive-form rejection.

Proof

• Multi-runtime unit tests.
• Integration test against a synthetic repository proving the object remains after inspection.
• No API path can omit --dry-run.

Dependency

Blocks git-stunts/git-cas#49 and git-stunts/git-cas#55.

[flyingrobots]

Implemented and merged in #7.

• The public API validates the cutoff and constructs the exact non-mutating, progress-suppressed streamed command. [cite: index.js#231-235@4a9c8f31ce71414031fc476ead3d85c3d98844a0]
• The sanitizer narrowly allowlists prune flags and rejects every prune invocation that lacks --dry-run/-n before end-of-options. [cite: src/domain/services/CommandSanitizer.js#103-129@4a9c8f31ce71414031fc476ead3d85c3d98844a0]
• The synthetic-repository witness observes the candidate and then proves the object still exists; a runner-level test pins the complete argv contract. [cite: test/PruneInspection.test.js#21-64@4a9c8f31ce71414031fc476ead3d85c3d98844a0]

Validation: ESLint; Node and Bun 174 tests; Deno 22 suites / 210 steps. CodeRabbit approved with all review threads resolved.