feat(app): remove downloaded models safely

[PhilipJohnBasile]

Fixes #374.

The desktop model picker now offers a confirmed Remove action for installed models. Removal delegates to the existing mtplx remove JSON contract, then refreshes the picker and model-update state.

Safety boundaries:

• only direct children of the managed MTPLX cache are removable
• the selected model and active model transfers are protected
• user-managed folders and cached symlinks do not get the app removal action
• explicit CLI removal unlinks a cache symlink without following or deleting its external target
• unexpected non-directory cache entries fail closed

The CLI removal command is now included in the README quick reference.

Validation:

• full Python suite: exit 0, 4,377 tests collected
• full Swift suite: 659 passed, 1 existing skip
• focused removal tests: 34 Python and 6 Swift passed
• real CLI temporary-cache removal smoke: passed
• swift build, Ruff, and git diff --check: passed

@youssofal, please review.

[youssofal]

Thanks. The safety boundaries are the right ones: only managed cache children, the selected model and active transfers protected, symlinks unlinked without following them. It overlaps the model picker work in flight for the next release, so it will be rebased and landed under your name once that settles. Not in 2.11.2.

[PhilipJohnBasile]

@youssofal Understood. I am leaving this scoped to safe removal and holding further picker changes until the in-flight picker work settles. The managed-cache, active-model/transfer, and symlink boundaries remain unchanged. The PR stays available for review and your credited integration; I have not introduced another picker implementation or treated the release hold as merge approval.