feat(storage): delete confirmed CKB-owned data without collateral loss

[akoita]

Parent epic: #113
Depends on the writer coordination, journal recovery, and retention contracts in this milestone.

Outcome

Delete a CKB and its owned durable data only after a precise preview and explicit confirmation.

Scope

• Produce a deletion plan grouped by owned data class and retention consequence.
• Require a visible confirmation token tied to that exact plan.
• Remove only records and managed artifacts whose ownership can be proven.
• Preserve unknown, legacy, shared, or externally managed entries.
• Record a content-free deletion result suitable for audit and recovery diagnostics.

Acceptance criteria

• A stale or mismatched confirmation cannot execute deletion.
• Cancellation and injected failure never produce silent partial loss.
• Unknown and unowned entries survive deletion.
• Completed deletion leaves no reachable owned CKB data except intentionally retained audit/backup records defined by policy.
• Shared CLI/desktop tests and pnpm validate pass.