Harden terminal progress and generated storage recovery

[joecklau]

Summary

• Render continuous terminal progress within the visible console width so wrapped PowerShell lines no longer accumulate while preserving non-interactive log output.
• Recover from manually deleted Docker Sandboxes receipt/evidence state by treating it as an untrusted cache miss while keeping corrupt or mismatched evidence fail-closed.
• Separate large disposable content under .local/cache from compact state and migrate legacy prebuilt archives.
• Add a previewed, hash-approved, config-scoped storage reset that preserves user configuration, shared resources, and exact ownership protections.
• Document generated files, safe deletion, external resource ownership, recovery, and the repository rule for agent scratch data under .local/tmp.

Validation

• Focused normal and race tests passed for terminal progress, image lifecycle, storage, catalog, configuration, provider registry, and CLI packages.
• Relevant go vet checks passed.
• Windows native-controller contract and PowerShell parsing passed.
• git diff --check passed.
• Local Bash execution was unavailable because the host WSL service returned E_ACCESSDENIED; repository CI remains the platform validation gate for the shell wrapper change.

Safety

Storage reset is preview-only until the operator supplies the exact generated plan hash. It does not issue broad Docker, BuildKit, Sandbox, WSL, or filesystem wildcard deletion.