feat(storage): add configurable decision log pruning

[slegarraga]

Closes #213

Summary

• Add an operator-initiated decision-log-prune command with optional max-age and max-retained-row policies.
• Delete only resolved decision rows; final verdicts are eligible, while AUTH rows remain protected until they have an explicit approved/denied/executed outcome.
• Keep pruning outside record_decision and leave the append-only policy-drift ledger untouched.
• Preserve redaction-safe CLI output and document the new command and exit codes.
• Pin age boundaries, row-budget retention, pending-AUTH protection, verdict stability, required policy validation, and writer append-only behavior.

Verification

• pytest tests/integration/test_decision_log.py -v — 10 passed
• Targeted suite: test_decision_log.py, test_cli_views.py, test_cli_help.py — 67 passed
• ruff check .
• ruff format --check .
• lint-imports
• Full suite with coverage: 3157 passed, 12 skipped, coverage 90.73% (threshold 80%).
• One unrelated pre-existing/local-environment failure remains isolated to tests/integration/test_real_plugin_install_discovery.py::test_installed_plugin_is_discovered_and_fires_despite_pip_target: the child interpreter cannot import the editable core (ModuleNotFoundError: doberman). It also fails on clean main locally. The remaining full suite is green.