Retention census streams directories and respects its deadline
The retention reaper's per-leaf directory probe loop ignored its deadline. The census now streams each directory with handle-relative reads, checks the bound per entry, and reports typed failures. When the census can't finish, the cleanup defers; an incomplete census is never treated as "nothing protected", so nothing is deleted on a partial answer. It still runs once per pass and changes no files. Fixture: 36% less time. Tests cover one census per pass, no mutation, deferral on a cut census, and nested aliases. Build-server checks timed out under load, so CI on all three platforms is the gate.
Summary by cubic
Streams the retention reaper's read-only protection census per directory with handle-relative reads and checks its deadline per entry, so cleanup stops on time and never treats a partial census as "nothing protected".
- An incomplete census defers cleanup with a typed failure (budget, cancelled, or unavailable) instead of authorizing deletion.
- The census still runs once per pass, changes no files, and preserves read-only permissions.
- Uses
direnttypes on Unix to skip non-directory entries without opening them. - Fixture runtime drops 36%; tests cover single-pass, no mutation, deferral, and nested aliases, including aliases reached by both plain and canonical paths.
- The fixture harness and release note were added; CI on all three platforms is the gate for this change.