fix(mcp): prune cached projects with missing roots

[lorenzozanee]

What does this PR do?

Cached project indexes from disconnected sessions remain after their worktrees disappear because they are no longer registered with the watcher. This adds a dry-run-by-default prune_projects MCP tool that identifies confirmed missing roots and removes the database and sidecars only after coordination.

Closes #1431

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

Supersedes #2100（原PR分支已删，按原提交重建）

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for the project-pruning proposal. This overlaps the API and deletion-policy decisions in #2236. We need more time to review the shared contract and safety requirements before making an integration decision. Neither proposal is being accepted or rejected by this triage.

[DeusData]

Thank you for this — pruning cached projects whose roots have disappeared is a real fix, and 341 lines with its own test coverage is careful work.

Two blockers, both mechanical.

1. The memory-core linter (this is what lint / lint is failing on, not clang-format):

memory-core linter FAILED: raw allocator use grew.
  src/mcp/mcp.c: grew by 7 (814 -> 821)
  latest sites: 18229:free, 18231:malloc, 18239:free, 18245:free, 18377:free, 18386:free

This repository routes every allocation through one core (src/foundation/mem_core.h) instead of the ~800 raw sites it used to have, because the memory accounting, the budget and the spill machinery all depend on seeing every allocation — a raw malloc/free is invisible to them. The linter ratchets: the existing sites are tolerated, new ones are not.

instead of	use
malloc	cbm_alloc
calloc	cbm_calloc
realloc	cbm_realloc
free	cbm_free
strdup	cbm_mem_strdup

Keep each pair on the same side: memory from cbm_alloc must be released with cbm_free, and anything that arrived from a raw malloc elsewhere must still go to raw free. If any of those seven sites free memory allocated by code you did not touch, say so and we will work out the right call together rather than have you guess.

make -f Makefile.cbm lint-ci reproduces this locally, and the memory-core linter takes --list if you want every site rather than the latest few.

2. The dco check is red. Your commits carry no Signed-off-by trailer — the message is a headline with an empty body, so there is nothing to parse. (It is not the blank-line trap, where a sign-off sits outside the trailer block and git ignores it while grep still finds it; here there is genuinely no trailer.)

git commit --amend -s          # single commit
git rebase --signoff origin/main   # several
git push --force-with-lease

test / test-msan and test / test-windows-guards reddening on some of your other branches are our infrastructure problems, not yours — the MSan lane fails on its Docker image build when apt.llvm.org is flaky, and the Windows guards job is known to redden unrelated PRs. Please ignore those two; I track them separately.

For what it is worth: #2241 and #2242 were signed off correctly and merged cleanly today, so you already have the habit — these branches just predate it.