Bound historical journal disk retention and expose eviction totals

[PLN]

Historical journal names previously accumulated on disk after their file handles were retired. Each store now admits at most 1 GiB including accepted buffered bytes and 8192 canonical current/archive filenames. At pressure it removes the least recently written historical unit's files, preserving all open/failed file owners and reserving the name against a concurrent reopen. If no eligible history exists, capture drains and reports rejected output through existing loss/storage counters.

The lazy index bounds enumeration and metadata, leaves control available on malformed/oversized history, and retries failed indexing with bounded admission. Deletion stays beneath the opened journal directory and outside store/queue metadata locks. Successful partial eviction and each rotation step update accounting once. New logEvictedFiles/logEvictedBytes status fields and machine CLI output distinguish retention from dropped output. The operations contract describes existing-history, external-writer and crash limits.

Validation: full local race suite passed (journal 46.612s, manager 61.071s); vet and Windows/Linux staticcheck passed. Focused final indexing/fallback/blocked-deletion checks passed after the final retry recheck. Portable/native tests cover buffered budgets, historical churn, restart indexing, oversize/nonregular input, exact rotation accounting, partial-deletion retry, genuine Windows sharing violations, independent sync/admission progress, and manager eviction totals after configuration removal. An existing concurrent-capture test now gives its later main wait a fresh one-second deadline instead of reusing the helper's consumed deadline; 30 single-worker race repetitions passed. Full diff/privacy review and documentation link/whitespace checks passed.

Exact-source CI 34776212301 passed. The disposable one-CPU SYSTEM/headless-standard-user matrix passed all 52 cases three times per identity without skips, in 59.156s and 61.255s. Exact source/four-binary identity, complete fixture/process/profile/linger cleanup and unchanged hosting broker were verified; raw evidence is retained privately. This implements the disk-retention slice; it does not close R5.3's remaining severity contract or the broader diagnostics/stress/MSI/pilot gates.