fix(storage): reclaim upgrade residue safely

[liuxiaocs7]

Summary

• resolve upgrade orphan paths through the existing Artifact removal identity mechanism
• retain orphan notes when a parent directory resolves outside the Artifact root
• preserve live Artifact bytes when a differently-cased orphan path aliases the same filesystem entry

Fixes #4910

Verification

• npm --workspace @maka/storage run build
• focused upgrade-reclaim tests: 3 passed
• NODE_NO_WARNINGS=1 npm --workspace @maka/storage run test:dist — 1129 passed, 8 platform skips, 0 failed
• npm --workspace @maka/storage run typecheck
• npx biome lint packages/storage/src/artifact-store.ts packages/storage/src/__tests__/artifact-stores.test.ts
• npx biome format packages/storage/src/artifact-store.ts packages/storage/src/__tests__/artifact-stores.test.ts
• git diff --check

Note: without NODE_NO_WARNINGS=1, the existing cross-process managed-dependency test treats Node's SQLite experimental warning on stderr as an error. The isolated failure reproduces independently of this change.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented the fix, added regression tests, ran verification, and reviewed the diff against the issue and repository standards. The commit includes the required Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Reviewed exact head 9052cb808cb7a5af0f8185b8228afe2b05b66286.

I found no P0–P3 correctness, ownership, race, path-containment, or cleanup-durability issue in the two-file diff. packages/storage/src/artifact-store.ts:484-526 resolves upgrade residue through real parents and entries, unlinks symlinks without following them, enforces real artifact-root containment, and protects current records through comparison identities. The tests cover an externally replaced parent directory, a case-insensitive live-path alias, and partial cleanup with retry persistence.

The exact-head hosted label, test, and windows_recovery checks passed. I did not independently run the Storage typecheck or tests because this checkout has no usable local TypeScript executable, and I did not run an additional filesystem fault-injection smoke test.

Automated review notice: This is an AI-assisted review and does not replace independent human review.