Clean duplicate active preview receipts

[rogu3bear]

Summary

• Add cfctl previews purge-duplicate-active for local preview inventory cleanup after repeated plan refreshes.
• Group active trusted preview receipts by lane plus policy/request/target fingerprints, keep the newest receipt, and remove only older local artifacts.
• Update README, runbook, runtime policy, static contract, and public-contract smoke coverage so the command stays part of the public cfctl previews surface.

Behavioral Changes

• cfctl previews rows now include trust fingerprints in the result payload.
• purge-duplicate-active reports purged_count, duplicate_group_count, and removed receipt metadata.
• Expired and legacy preview cleanup remain separate commands; this path does not run --ack-plan or mutate Cloudflare.

Implications

• Repeated safe --plan refreshes can be compacted without losing the newest actionable operation id for a concrete request.
• Maildesk sender-domain readiness receipts should be easier to read after refresh automation runs.
• Existing preview/apply trust validation remains unchanged.

Risk Areas / Confidence

• Duplicate key selection: high confidence. It uses lane plus policy/request/target fingerprints already required for trusted preview validation.
• Deletion scope: high confidence. The implementation filters to active, non-expired, trust-complete local receipts and removes older siblings only.
• Runtime docs/contract drift: high confidence. Static assertions and public-contract smoke checks were updated.

Test Plan

• ./scripts/verify_static_contract.sh
• python3 scripts/verify_permission_catalog.py --cfctl ./cfctl
• ./cfctl previews purge-duplicate-active | jq '.summary'
• ./cfctl previews purge-expired | jq '.summary'
• ./cfctl doctor | jq '.summary'
• ./cfctl previews | jq '.summary'

Review Focus

• Confirm the duplicate key should not include operation_id, since that is the value repeated plan refreshes intentionally change.
• Confirm expired previews should stay owned by purge-expired rather than being removed by duplicate-active cleanup.

Next Steps

• After merge, use the new command from the maildesk private checkout to compact duplicate sender-domain plan receipts before the next readiness readback.
• Protected --ack-plan sender-domain mutation remains outside this PR and still needs explicit operator approval.

[rogu3bear]

@codex Please review the duplicate-active preview cleanup semantics: should the dedupe key remain lane + policy/request/target fingerprints without operation_id, and should expired receipts continue to be excluded so purge-expired remains the only expired-preview deletion path?