Add safe cleanup, offline diagnostics, and dependency queries

[LunaStev]

Summary

Add explicit build/dependency cleanup and local diagnostics for day-to-day Vex use, with inverse/depth tree queries, quiet/verbose output, and elimination of redundant fetches after an initial clone.

Closes #49
Closes #88
Closes #53
Closes #62
Closes #64
Closes #43

Related roadmap: #99 (remains open).

Why

Projects need to reclaim generated output and unused checkouts without deleting user changes or disrupting running programs. Local tool diagnostics and resolver decisions should be available without implicit network access or mixing machine-readable output into program streams.

Behavior

• vex clean removes recorded, unchanged build outputs; --dry-run previews without mutation. Existing untracked outputs, modified files, sources, manifests, lockfiles, and live run generations are preserved. Independent inherited OS leases protect running generations after the build lease is released. No automatic GC is introduced.
• vex prune previews unused checkouts and requires --apply for deletion. It validates a complete current local graph without fetching, refuses pending recovery, and preserves legacy/unrecorded or changed checkouts, including ignored files and Git metadata. Ownership is recorded for newly created checkouts; copying/updating an untrusted checkout cannot restore deletion eligibility. There is no shared cache, so restoring a removed dependency may require fetching from its source.
• vex doctor [--format=json] [--target <triple>] reports tools, compiler capabilities, local project-plan compatibility, and linker availability without creating, fetching, recovering, compiling, or linking. JSON uses schema v1. Unavailable local graphs remain explicit warning/not-checked results; a successful report does not prove an actual target link.
• Global --quiet, -v, and -vv preserve errors, warnings, program stdio/exit codes, and JSONL records. Verbose decisions and diagnostic context are credential-redacted.
• tree --invert <name> and --depth <n> retain deterministic shared-node rendering and locked/offline behavior. Metadata continues to expose the underlying graph.
• Initial clones reuse available branch/tag/revision/default-branch refs. Missing objects and explicit updates still fetch as needed, including SHA-256 repositories and long-path initialization.
• Update the CLI reference, operational/doctor contracts, roadmap, and real-Wave smoke. No release version or CI requirements change.

Validation

• cargo fmt --check
• cargo test --workspace --locked
• cargo clippy --workspace --locked --all-targets -- -D warnings
• cargo build --workspace --locked

python3 x.py check passed, including 38 Python tests and the workspace Rust suite. Final cleanup regression tests passed (9 clean + 10 prune), including live/orphaned program leases, unknown/modified files, recovery refusal, path containment, and ownership preservation across updates.

cargo check --workspace --all-targets --locked --target x86_64-pc-windows-gnu passed; this is a cross-compile check, not native Windows execution.

The extended tests/wave_compatibility.py --reexports --expected-version 0.2.1-pre-beta passed with the installed Linux compiler, executable SHA-256 e4439dc77b0a142dd38e22406cf489c2ee123bcf2ec474afbefd072078a0e504. This local binary's build provenance was not independently established. Required PR CI must still validate all nine platforms against the pinned public Wave artifacts.

Generated CLI-reference and local documentation-link checks passed. The locked dependency versions are unchanged; the state crate reuses existing serde/SHA-256 dependencies and the license-notice lockfile fingerprint was regenerated.

Checklist

• The change is focused and targets wavefnd/Vex:master.
• User-facing behavior and recovery instructions are documented.
• Dependency changes preserve lockfile reproducibility.
• --locked and --offline behavior remains correct.
• No raw wavec flags were added to the Vex CLI.
• New commits include a DCO Signed-off-by: line.