Sweep a killed request's tree from a supervisor-forked sweeper

[flavorjones]

The supervisor renamed a killed worker's home aside and left the unlinking to
the next worker that answered on that slot. A worker killed at its deadline
never reached that sweep, so a slot whose every request was killed stacked
one tree per kill until the scratch was full.

Fork a Sweeper every sweep_interval seconds when a slot holds a discarded
tree, hold it to the cell's deadline, and run one at a time. The worker's
own sweep stays as the fast path; Filesystem.remove_tree now counts a tree
the other sweeper removed first as removed. See HotCell::Sweeper and the
sweep_interval row in docs/DEPLOYMENT.md.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[flavorjones]

🤖 Adversarial review by Codex, three rounds, converged.

Fixed (commits eec09ad and c50f6d1)

• Filesystem.remove_tree read a path it could not stat as gone, so a tree behind a slot directory a tool made unsearchable was counted as swept. present? now uses lstat; only ENOENT means gone.
• The supervisor's due-check listed and sorted every slot directory in its loop. Slot#discarded? streams the directory and stops at the first match.
• A sweeper that died by signal left no line. reap logs sweeper.died with signal and exit code unless the deadline kill already logged it.
• Applying every worker limit to the sweeper put RLIMIT_FSIZE on a process whose only writes are log lines; a regular-file log past file_size killed it on its first line. It applies memory alone now.
• slot.unswept was documented WARN but missing from Log::LEVELS; added. hotcell.swept reworded in docs/LOGS.md.
• Tests: EACCES sweep, discarded?, signal death, file_size regression, and both signal tests now assert a replacement sweeper forked.

Declined, with reasons

• Rewrite Filesystem as a streaming remover so a directory wider than the memory limit makes progress: a rewrite for an attacker-shaped case the pre-existing worker sweep shares. Risk recorded in the Sweeper#run comment.
• Reject Float::INFINITY for sweep_interval: queue_wait and control_deadline take the identical path; a fix belongs to all three, outside this PR.
• Replaced-slot-directory symlink TOCTOU during a sweep: same-uid actor can already delete anything this uid owns; Codex rated it correct but not worth doing.
• A test-only pause hook in Sweeper for deterministic signal tests: the tests fail loudly rather than pass falsely, and the timing margin is hundreds of ms against a 20ms poll. Will revisit if CI flakes.