feat: local prune of synced sessions

[upsetbit]

What

Adds prosa prune: sessions already pushed to the server and inactive beyond a window (default 30d) get their local raw copy deleted, while the store keeps pointing at the remote location. Pruned sessions stay fully listed, searchable, and viewable offline — turns, FTS, usage, tools, and analytics all live in store.db and are untouched. Only raw reads change: prosa show --raw (and the non-TTY pipe default) stream a pruned session's raw from the server via the existing GetRaw RPC.

Nothing is ever pruned automatically. prosa sync now prints an advisory-only summary line (count + reclaimable disk) when prunable sessions exist; the --json summary carries prunable_sessions / prunable_bytes.

How

• Migration 0011_push_prune: sync_state gains pushed_at / pushed_hash / remote_uri (transport state — until now the CLI had no local record that a session reached the server); sessions gains pruned_at.
• Push state: every confirmed push records the server-acknowledged hash and S3 URI; sessions pushed before these columns existed are backfilled from the server manifest during reconcile, so one ordinary sync populates everything.
• Safety model: a prune candidate needs a locally recorded push whose hash still matches the raw, and the server manifest re-confirms every id (hash + current projection version) at prune time before any file is deleted. No login or unreachable server ⇒ hard error, nothing deleted. The DB flips pruned_at before the file is removed (a failed delete reverts), so sync can never chase a missing raw.
• Sync fences: reconcile excludes pruned rows from the catch-up work set (including under --overwrite and after future ProjectionVersion bumps); the denoise sweep skips them; pushSession short-circuits them. A re-import of a changed source file rewrites the raw and un-prunes the row atomically.
• Zero proto/server changes — PushResponse.raw_uri and GetRaw already existed; the CLI just starts using them.

Scope note

This amends INTENT.md §Out of scope: retention stays never automatic, but explicit, server-verified pruning now exists; the push-only posture is unchanged for sync (a pruned raw streams on read but never re-enters the local store). AGENTS.md, docs/concepts.md, docs/architecture/{store,cli}.md, docs/usage.md, and the rendering contract are updated to match.

Upgrade note

Migration 0011 means read-only commands (prosa, show, search, analytics) return the usual ErrStoreNeedsMigration guidance after upgrading until the first write command (prosa sync) runs — same behavior as every prior migration.

Verification

• Unit tests across store (migration, candidate filters, guarded flip, advisory, un-prune), sync (push recording, reconcile exclusion + backfill), prune (dry-run, hash mismatch, offline, idempotency, NDJSON shape), and show (pruned raw fallback, login error, rendered annotation).
• just ci green (fmt, vet, lint, race tests, gen-check, tidy-check).
• Full-stack e2e against a throwaway Postgres + MinIO + prosa-server: sync pushes, prune deletes and records the real s3:// URIs, list/search/show stay local, show --raw streams byte-identical raw from the server, and a follow-up sync converges with pruned rows excluded.

🤖 Generated with Claude Code