fix: list unreferenced data files newer than the retained floor

[jennifermell]

Summary

• cleanup_old_versions clamped its data/ listing to earliest_retained_manifest_time. That floor is only sound for a file owned by a manifest being removed; a file owned by no manifest — abandoned write_fragments() output — has an mtime unrelated to it.
• Such a file is documented to be removed on its age, but it was never listed, so its age was never consulted and delete_unverified=true had no effect on it.
• When every aged version is retained (e.g. pinned by a tag) no manifest is deleted, so fix: delete data files when cleanup retains an older tag #8708's escape hatch cannot fire and the floor never advances: the orphan is collected by no run at all.
• The data/ listing now runs through the moving unverified threshold — earliest_retained.max(verification_threshold) — and drops the cutoff entirely under delete_unverified, where a file is a candidate at any age. CleanupInspection::listing_unmodified_since is unchanged, so fix: delete data files when cleanup retains an older tag #8708's sparse-retain case and the other listings behave exactly as before.
• This restores an advancing cutoff, which is what the listing had before feat: add new cleanup policy to retain latest n versions #4614 (the caller's now - older_than, per A tagged version permanently prevents cleanup_old_versions from reclaiming newer data files #8516). A tagged version permanently prevents cleanup_old_versions from reclaiming newer data files #8516 and cleanup_old_versions on a tagged dataset removes manifests but strands their data files (permanent, silent leak) #8705 reported the tagged facet of the same clamp and fix: delete data files when cleanup retains an older tag #8708 fixed it; this is the facet left over, reachable with no tag at all.
• Documents the contract the change relies on, which the Rust API and the guide had drifted from: an unverifiable file is removed once it is at least 7 days old, that threshold is fixed and independent of older_than, and delete_unverified removes the age protection entirely and requires that no other process is operating on the dataset. The Python docstring already said this.
• Adds cleanup_deletes_aged_orphan_newer_than_retained_manifests, covering both paths: an aged orphan under the default policy, and a fresh orphan under delete_unverified. Both are written after every manifest, under suffix-only retention with no tag anywhere.

_transactions/ and _deletions/ are clamped the same way and can strand a file for the same reason. Left for a follow-up so each gets its own regression test rather than widening destructive discovery across four subtrees at once.

Fixes #8942

Test plan

• cargo fmt --all --check — clean
• cargo check -p lance --tests — clean
• cargo clippy -p lance --tests -- -D warnings — clean
• cargo test -p lance --lib dataset::cleanup — 46 passed, 0 failed, including both new cases and fix: delete data files when cleanup retains an older tag #8708's cleanup_deletes_data_files_newer_than_tagged_version
• Mutation check: reverting the data/ cutoff to unmodified_since fails case_1_aged; removing only the delete_unverified arm fails case_2_delete_unverified. Each case is gated on the branch it covers, and no other test changes outcome.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The earlier safety-documentation finding is addressed. The data listing now advances with the seven-day verification threshold, removes that cutoff only when delete_unverified is enabled, and has focused regression coverage for both policy branches.