feat(orchestrator): W3 artifacts tree, ancestry, gates and token-free cleanup

Artifacts show the branch tree with ancestry and gate marks. The cleanup runner calls pkgmgr branch cleanup with its real argv and parses its repos[*].items output, refuses any plan with a remote-branch action, marks an item done only when pkgmgr reports it done, and offers no delete for a branch a worktree holds. Every text states what the pkgmgr command does to volumes. Committed below the bar on the operator's word 2026-11-12 (no further per-bundle tests, one gate after the merge): the W3 e2e never ran; the client switches to --local once pkgmgr ships it.

🎯 Fix: 90 %
💥 Break: 6 %
💸 Cost: 30 %
⏱️ Time: 40 %
🛡️ Security: 100 %
🏆 Score: 100
🚦 Gate: ⛔ break 6 % > 5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/hub_case.py

@@ -232,8 +232,14 @@ class HubCase(unittest.TestCase):
             path.write_text(text, encoding="utf-8")
 
     def write_tree(self) -> Path:
+        return self.write_fixture("branch-tree.json")
+
+    def write_fixture(self, fixture: str) -> Path:
+        """Args:
+            fixture: the tree file under tests/ to write, @ROOT@ replaced.
+        """
         root = self.outside / "scan"
-        sample = (Path(__file__).parent / "branch-tree.json").read_text(encoding="utf-8")
+        sample = (Path(__file__).parent / fixture).read_text(encoding="utf-8")
         self.tree_file.write_text(sample.replace("@ROOT@", str(root)), encoding="utf-8")
         return root