fix(clean): don't flag GUI app dotdirs as orphan when a matching .app or cask exists (#872) (#879)

* fix(clean): skip orphan hint for dotdirs owned by GUI app or cask (#872)

`show_orphan_dotdir_hint_notice` now adds a fifth ownership gate that
exempts a hidden home directory when an installed `.app` bundle or a
Homebrew cask shares a name token with it.

Without this, `~/.bridge` (Proton Mail Bridge live data) is flagged as
orphan because there is no `bridge` binary on PATH and no LaunchAgent
referencing it. The existing gates (allowlist, whitelist, `command -v`,
LaunchAgents grep) only cover CLI-style owners.

New helper `dotdir_has_owning_gui_app NAME`:

  - Scans `.app` filenames in /Applications, /Applications/Setapp,
    \$HOME/Applications, plus `brew list --cask` output.
  - Tokenizes both sides on non-alphanumeric chars, lowercases.
    `Proton Mail Bridge.app` -> proton, mail, bridge.
    `proton-mail-bridge`     -> proton, mail, bridge.
  - Requires token length >= 4 on both sides to avoid matching
    `.ai-old` against `AI.app`.
  - Caches the token list at
    \$HOME/.cache/mole/installed_app_tokens_cache (5-minute TTL,
    same pattern as scan_installed_apps).

The new gate is inserted between the LaunchAgents grep and the size
calculation in `show_orphan_dotdir_hint_notice`.

Tests in tests/clean_hints.bats cover:

  - dotdir matched by fake .app -> not flagged
  - dotdir matched by fake brew cask -> not flagged
  - dotdir with no matching app/cask -> still flagged
  - short app tokens (<4 chars) do not exempt the dotdir

* fix(clean): use POSIX character classes in tr (shellcheck SC2018/SC2019)

Replace `tr 'A-Z' 'a-z'` with `tr '[:upper:]' '[:lower:]'` in the
helpers added by the previous commit. The locale-aware form is what
shellcheck and the repo's check.sh require.