feat(optimize): prune orphaned Spotlight search rules (#1000)

Uninstalling an app, notably an iCloud-synced Mac App Store app, can leave
its bundle id behind in com.apple.spotlight EnabledPreferenceRules, where
it lingers as a dead row in System Settings > Spotlight. macOS never prunes
these and there is no UI to remove them.

The new spotlight_orphan_rules_cleanup task scans the array and drops only
reverse-DNS entries whose app is gone (confirmed via bundle_has_installed_app),
then rewrites the filtered array through defaults so cfprefsd and System
Settings stay consistent. System.* and com.apple.* rules are always kept,
and dry-run never writes. Registered in the health JSON task list, the
optimize dispatch, and the optimize whitelist.