fix(cowshed): key retired gc authority on incarnation, not workspace name

Trash entries are `sessions/.trash/<name>-<incarnation>`, but
gc keyed cleanup authority on the name alone. Retiring one name
twice therefore presented as ambiguous authority rather than as two
independent entries, and gc refused to collect anything in the project:
`duplicate retired cleanup authority for <ws>` with the name idle, or
`retired trash conflicts with canonical workspace <ws>` once the name
had been re-minted. Both forwarded to `doctor --json`, which reported
a healthy host with zero findings, so the operator had no next move.

Authority is now the `<name>-<incarnation>` pair, so N retirements of
one name are N independently collectable entries and a live workspace
no longer blocks collection of retirements that are not it. Both
messages are gone.

What a name-keyed claim really covered was the two paths that genuinely
are keyed on the name — `checkpoints/<name>` and the mountpoint —
because re-minting a name hands the new lifetime the same ones. Those
are now scoped separately: they belong to whoever holds the name now, a
live canonical image if there is one and otherwise the newest retirement
still in trash, while every other retirement collects only its own
per-incarnation artifacts. The scope is derived from trash filenames,
which `retired_authority` already proves agree with each sidecar,
so preview and execution cannot disagree and revalidate as stale.

`doctor` now reads gc's own preview instead of staying silent:
stranded retirements are a `retired-trash` warning naming `cowshed
gc`, and a preview that cannot be taken at all is a `gc-preview`
error rather than a healthy host.