fix(clean): make dry-run and real clean agree on protected orphan plists (#886) (#895)

`mo clean --dry-run` reported orphaned LaunchDaemons (e.g. the Microsoft
Office helper at `com.microsoft.office.licensingV2.helper.plist`) as
"would remove", while the subsequent real `mo clean` silently skipped
them: the `should_protect_path` check ran only inside the real-clean
branch, so dry-run never consulted protection rules and printed an
unreachable promise.

Fix in `lib/clean/apps.sh`:

  - Lift `should_protect_path` above the `DRY_RUN` branch so both modes
    consult it. Protected files now stop the loop body with a single
    `Skipping protected orphaned service` debug entry regardless of
    mode.
  - Ungate the summary line `"Orphaned services skipped N protected,
    failed N"` so it prints in dry-run too. The user now sees what was
    held back; previously dry-run was silent about protected hits.

Tests (`tests/clean_apps.bats`):

  - `dry-run skips protected paths (#886)` — protects every orphan,
    asserts dry-run does NOT print "Would remove" and DOES print the
    skipped summary. Without the fix this case used to print "Would
    remove" in dry-run.
  - `dry-run reports unprotected orphans (#886)` — confirms the
    non-protected path is unchanged: dry-run still prints "Would
    remove" and never prints "Skipping protected".

Both tests pass `MOLE_TEST_NO_AUTH=0` explicitly so the function runs
past the CI auth-skip guard (`scripts/test.sh` exports
`MOLE_TEST_NO_AUTH=1`), and use `|| return 1` after each `[[ ]]` so a
failing assertion in the middle of the body fails the test instead of
being swallowed by a later passing one.

Closes #886