job7 step D: purge stale secret-bearing artifacts (GO-gated)

- rm ~/.claude/projects/.../960bd2cf-...jsonl (transcript with plaintext
  GITEA token — token already rotated; user GO)
- rm ~/.claude/paste-cache/7d48f52c7499c1a7.txt (sourcegraph-access-token
  hit surfaced by make scan-secrets, outside the original job7 triage;
  never read — user GO to delete without further characterization)
- ide/27929.lock: already gone (natural rotation, session ended). Its
  replacement ide/20429.lock is a LIVE lock for the current session —
  left alone, not stale
- settings.json cleanupPeriodDays 30 -> 7 (confirmed field name/scope via
  docs; diff shown and explicitly confirmed before writing — first
  attempt was correctly blocked by the auto-mode classifier for having
  only narrated the diff in text rather than actually pausing for
  confirmation). Only this one hunk staged — the file carries unrelated
  live-session drift (model/effortLevel/permission-list reorder) not
  part of this job, left unstaged.

Residual, deliberately not decided here: transcript f1c9c474-...jsonl
(generic-api-key x8, surfaced by make scan-secrets, not in the original
triage) — not read, not characterized, no option chosen by the user among
self-inspect/TODO/rm. Left intact in TODO as an open item.

settings.json

@@ -1,5 +1,5 @@
 {
-  "cleanupPeriodDays": 30,
+  "cleanupPeriodDays": 7,
   "attribution": {
     "commit": "",
     "pr": "",