Record preview metadata on a deployment, and expire previews #3048

Problem

A PR preview is an ordinary component. Nothing records which repository, PR, branch and commit it came from, and nothing removes it if the PR's close event never runs.

The documentation site's PR previews filled their instance's disk this way. Previews whose cleanup didn't run piled up until every deploy failed with EDQUOT (HarperFast/documentation#695).

Proposal

• deploy_component accepts optional preview metadata: { app, repository, pr, branch, sha, expiresAt }. It is kept with the deployment's provenance (.harper-deployment.json, Staged component deploys: land build-aside-then-swap as a sequence of small PRs #2315 step 5) and returned from get_components and list_deployments.
• A leader-only sweep drops previews whose expiresAt has passed. The drop is replicated and doesn't restart the pool.
• A per-application cap (maxPreviews) refuses a new preview beyond it, with a message that names the oldest one.

Done when

• An expired preview disappears from every node without operator action.
• get_components shows each preview's PR and commit.

Part of #3042.

Update, 2026-10-07

The documented recipe (HarperFast/documentation#715) has no expiry. Cleanup relies on close and retarget events, and on an administrator rerunning failed cleanups. With #3091, the sweep here can verify removal on every node from one call.