Hold back the Disk panel and OS drag-out from the ship branch

This is a scope reduction, not an abandonment. Both subsystems are
preserved in full on `hold/disk-and-dragout` and are intended to come
back once they have been hardened separately. Nothing here is a
judgement that the features are unwanted — three successive
audit-and-fix cycles each closed a critical defect in these two areas
and each opened a new one, so the rest of the round ships now and these
two get their own cycle rather than holding it up.

Removed: the Disk settings panel and its whole reclaim / destroy /
compaction surface — `DiskSettings`, `DiskProjectTable`, `useDiskUsage`,
`docker/disk.rs`, `disk_tests.rs`, the disk commands in
`docker_commands.rs`, and their `generate_handler!` entries. Dropping
the IPC entries is the point: a UI-only removal would have left five
commands callable by a compromised webview, one of them a verified
arbitrary-DELETE primitive. `sweep_orphaned_snapshots`'s *command* goes
with them (the panel was its only caller); the sweep itself stays.

Removed: OS drag-out from the Files tab — `stage_container_file_for_drag`
and its host staging lifecycle, the pointer gesture and `dragPreview`,
`stageForDrag` / `isStagedHostPath`, the `tauri-plugin-drag` and
`@crabnebula/tauri-plugin-drag` dependencies, and the
`drag:allow-start-drag` capability grant, which could not be scoped.
The capability test's expected list is updated; its `*:default` and
`store:*` assertions are untouched.

Kept, deliberately: drag-and-drop *into* the app (Files pane and
terminal) and "Save to host…", which is now the only route out of a
container. The prevention work is untouched — the pre-commit scrub and
`SNAPSHOT_SCRUB_PATHS`, capped container logs, the `triple-c.base` /
`triple-c.managed` labels, `sweep_orphaned_snapshots` and the startup
housekeeping, the migration pin/probe reapers, scheduler log pruning,
`formatBytes.ts`, and `project_lock.rs` in full with every acquisition
site outside `disk.rs`.

Entanglements, resolved rather than deleted blind:
* `container.rs`'s `a_compaction_runs_this_module_s_scrub_script_byte_for_byte`
  pinned the compaction Dockerfile against `snapshot_scrub_script()`.
  Dropped — it existed only for compaction. `snapshot_scrub_script` and
  its containment tests are untouched.
* `lib.rs`'s startup reap of `:compacting` tags and `triple-c-compact-*`
  containers is dropped: nothing on this branch creates them.
* `project_lock`'s `Compaction` / `CacheClear` variants and
  `any_held_excluding`, `migration_commands::is_migrating`, and
  `formatBytes{Delta,Ceiling}` lose their last production caller but are
  kept and still tested, annotated with why.
* `projects_store::corrupt_since` and `migration_store::peek_ownerless_since`
  were read only by the disk survey and are removed. The corrupt-load
  marker and `.bak` are still written.

Verified: `npm run test` 611 passing, `npx tsc --noEmit` clean,
`npm run build` green; `cargo test` 419 passed / 2 ignored,
`cargo build` 0 warnings. Every test removed belongs to a removed
feature — no kept-behaviour test was weakened or deleted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src-tauri/src/project_lock.rs

@@ -61,8 +61,7 @@
 //! does do about it is bound the damage: [`any_held_excluding`] lets the daemon-wide
 //! reapers skip work while this process is mid-operation, and the reapers
 //! themselves gained age gates so a young container belonging to somebody else
-//! is left alone (see `docker::disk::reap_stale_compaction_artifacts` and
-//! `docker::migration::reap_probe_containers`).
+//! is left alone (see `docker::migration::reap_probe_containers`).
 //!
 //! ## Refuse, do not queue
 //!
@@ -85,6 +84,13 @@ pub enum ProjectOp {
     /// `confirm_migration`.
     Migration,
     /// `disk::compact_snapshot` — the long one, and the reason this exists.
+    ///
+    /// Not constructed on this branch: the Disk panel and its compaction were
+    /// held back for separate hardening and live on `hold/disk-and-dragout`.
+    /// The variant stays because this registry is the thing that made those
+    /// operations safe to re-land, and a re-land that had to re-derive the
+    /// claim classes would be re-deriving the bug.
+    #[allow(dead_code)]
     Compaction,
     /// Start / stop / recreate. Anything in `start_project_container`'s path.
     Recreate,
@@ -95,6 +101,10 @@ pub enum ProjectOp {
     /// `disk::clear_caches` — an exec into the live container. It does not
     /// write `:latest`, but it must not run while the container is being
     /// removed out from under it.
+    ///
+    /// Not constructed on this branch, for the same reason as
+    /// [`ProjectOp::Compaction`].
+    #[allow(dead_code)]
     CacheClear,
     /// `container::scrub_secrets_from_snapshots` — the third writer of
     /// `triple-c-snapshot-{id}:latest`, reached from `clear_claude_token`. It
@@ -220,6 +230,12 @@ pub fn is_held_by(project_id: &str, op: ProjectOp) -> bool {
 /// only in-process question they can ask before force-removing one. The
 /// exclusion is for the reaper that runs *inside* a compaction, which is
 /// already holding a claim of its own and would otherwise see it and skip.
+///
+/// No production caller on this branch: the compaction reaper it was written
+/// for went to `hold/disk-and-dragout` with the rest of the Disk panel. Kept
+/// (and still tested) because it is the only bound this module offers on the
+/// cross-process case documented above.
+#[allow(dead_code)]
 pub fn any_held_excluding(op: ProjectOp, exclude_project_id: &str) -> bool {
     holders()
         .lock()