feat(disk-hygiene): post-#160 follow-ups — leak-signature hints, standing policy discovery, OS auto-clean awareness

[kyle-sexton]

Summary

Post-ship follow-ups for disk-hygiene (built and closed in #160), from a verified gap analysis of the shipped source against the plugin's own origin issue, docs/PLUGIN-PHILOSOPHY.md, and docs/MIGRATION-PLAYBOOK.md. Three worth-doing-now changes, two small hygiene items, three explicitly deferred items with triggers.

Worth doing now

1. Ship #160's own leak signatures as hint patterns

skills/clean/reference/baseline-policy.json carries only generic discovery hints (*.tmp, tmp-*, *.lock, __pycache__, .DS_Store, Thumbs.db, *.partial, *.crdownload). None of the agent-leak families #160 named as the plugin's reason to exist are present:

• .claude.json.tmp.<pid>.<hash> — failed atomic write
• temp_git_* — agent scratch leakage
• .pulumi-write-test-* — orphaned writability probe

Ship these as hint-only discovery patterns (never auto-delete; classification still owns the verdict). This is the actionable core of "context-aware classification, not a denylist."

2. Auto-discover standing policy files; keep --policy for one-offs

Today the only extension seam is a per-invocation --policy file. Per PLUGIN-PHILOSOPHY's configuration-ownership table, a consumer's standing protected-path denylist and hint extensions are "tracked repository convention or rich team policy" → a documented file under the consumer project; the explicit skill argument is for "invocation-specific choice." Add auto-read of:

• ${CLAUDE_PROJECT_DIR}/.claude/disk-hygiene.yaml (project)
• ~/.claude/disk-hygiene.yaml (user-global)

with --policy retained as the one-off override. Safety: load_policy (hygiene.py:275-320) is additive-only — overlays can add protections or hints, or disable discovery hints (which can only cause junk to be missed), and baseline protected names + hard predicates are non-removable — so ambient config cannot widen the destructive surface.

3. OS auto-clean awareness (report-only)

The "defer to the owning system's GC" rule exists for product-managed state (SKILL.md step 2.3) but not for OS-level auto-clean. Extend it report-only: detect Windows Storage Sense config (HKCU\...\StorageSense\Parameters\StoragePolicy; cadence value semantics 0/1/7/30), systemd-tmpfiles on Linux, macOS periodic — and when a scanned zone is one the OS mechanism would manage, recommend enabling/tuning it instead of hand-cleaning. Field evidence: this machine had Storage Sense enabled but cadence=0 (low-disk-only), which never fires at 1.1 TB free — 21.8 GB of stale %TEMP% accumulated invisibly.

Small hygiene items

• validate_plan requires native_gc_evidence.result == "eligible" for managed owners (hygiene.py:627-637), but preview (:982-983) and apply_plan (:1205-1206) unconditionally block managed owners with native-managed-report-only. The eligibility evidence can never change an outcome; simplify or document why it is demanded.
• The 250k-entry scan cap aborts via HygieneError (hygiene.py:472-475) instead of degrading (partial scan + explicit coverage-gap report). Low priority.

Deferred (explicit, with triggers)

• Reversible disposal (Recycle Bin / XDG trash). Trash is a path-based move that reintroduces TOCTOU against the descriptor-anchored unlink design. Trigger: a TOCTOU-safe trash primitive, or a non-technical-user audience.
• RELOCATE disposition (move misplaced-but-legit files home). A move engine is a distinct capability from audit+remove. Trigger: recurring demand in real runs.
• Windows/macOS deletion lanes. Complies with declared-OS-specific rule (safety-model.md: no authoritative descriptor-anchoring proof on those platforms), but note feat: new plugin audit-artifacts — context-aware directory junk audit with tiered, gated cleanup #160's validation ran on Windows, which can audit and never delete. Trigger: proven TOCTOU-safe Windows deletion primitive.

Verified as shipped (no action)

Per-tier human gate with snapshot-nonce-bound approval tokens; defer-to-native-GC for managed owners; per-sibling re-resolution; distinct needs-elevation outcome; disk-hygiene:clean naming symmetry. Closing-comment items 1-5 of #160 all landed; item 6 (config in overridable config) is what change 2 completes.