never mid-build

hal
gc
- replaced the blunt cleanup of
~/.selfactor/.gcwith one that can be aimed at a free-space target- candidates come only from that file, parsed as gitignore rules, so the path list is never copied into code
- eviction goes oldest-updated first and stops the moment the target is met
- a candidate is skipped when a build process is working inside its project root, or when something wrote into it inside the recent-write window
- the blunt all-of-it path is still there, as a second script with no ordering and no guards
- fourteen match cases plus the walk and delete path run as a selftest before anything is removed
- each rule was written down with the check that proves it
plan images
- hero images had been falling through to deferred every morning because the Grok token resolver still read its payload from a directory that no longer exists
- the resolver now asks whichever agent app is actually installed, and the first attempt after the change produced an image
- the post from the night before had gone out without its picture and got one four minutes after the fix