feat(sync-agents): prune dangling dotfiles symlinks from project repos

[indykish]

What

sync-agents was additive-only: dropping a manifest entry left the old symlink dangling in every downstream repo, with no way to clean it. After the dispatch switchover (PR #18) deleted docs/gates/, ZIG_RULES.md, BUN_RULES.md, AGENTS_INVARIANCE.md, and relocated scripts/audit-*.sh → audits/*.sh, those links went dangling in usezombie and cache-kit.rs.

This adds a prune pass that closes the gap permanently — every future ruleset restructure self-heals.

How

• prune_orphans <root> — after linking, removes any symlink under a project repo that is dangling AND resolves into $DOTFILES (a provably-broken orphan from a deleted/renamed source). Valid links and links pointing outside $DOTFILES are never touched. Excludes .git/node_modules/.zig-cache.
• Filesystem-only, no git mutation — the removal surfaces as a staged deletion on the repo's next git add -A, exactly mirroring how an added link awaits the user's commit. sync-agents stays a filesystem tool; you stay the committer.
• normalize_path — collapses ./.. textually (no realpath — the target is gone), string-built to stay safe under macOS bash 3.2 + set -u.
• Default on; --no-prune disables. New pruned=N field in the summary; --list documents it.

Verification

• bash -n clean · shellcheck -S warning clean · file 336 lines (< 350 gate)
• Sandbox unit-test: absolute orphan → pruned ✓ · relative orphan → pruned ✓ · valid link → kept ✓ · dangling-outside-dotfiles → kept ✓
• Live run: linked=20 retargeted=0 pruned=32 skipped=0 failed=0 across usezombie (13 orphans) + cache-kit.rs (19), zero dangling links remaining in either.

Session notes

• The dangling cleanup was executed this session by running the branch version directly; usezombie is staged-ready for its own cleanup commit (handled separately — its repo, its commit). cache-kit.rs was left untouched (it carries unrelated in-flight M092 spec work).

🤖 Generated with Claude Code