Surface OrbStack and Claude cleanup opportunities

Adds review-only OrbStack storage visibility, protected OrbStack data paths, and guarded Claude Desktop bundled Claude Code version cleanup without touching session history or volume data.