Add expiring artifact delivery outbox

[jugol]

What changed

• add artifactctl for fixed seven-day delivery packages, inspection, and permanent expiry cleanup
• run cleanup from a hash-pinned SessionStart hook and an hourly local scheduler
• fail closed when legacy output/ entries have not been reviewed and migrated
• document the boundary between temporary delivery files and durable memory preservation

Why

Generated deliverables were accumulating beside durable agent state without a reliable lifecycle. This makes output/ explicitly temporary while preserving exact files only through the existing, approval-gated private-vault workflow.

Impact

Agents now deliver files with an exact expiry timestamp. There is no keep marker or caller-selectable extension. Existing pre-policy output is never silently enrolled, and publication checks prevent delivery artifacts from entering Git.

Validation

• 23 artifact lifecycle tests
• Python and PowerShell smoke tests
• Python/PowerShell interoperability test
• prepublication smoke and public-boundary checks
• independent standards and specification reviews