fix(cli): disclose the orphaned raw copy after forget and lint unreferenced raw files

[jasonssdev]

Summary

After forget removed a Source, its raw/ copy stayed on disk and in git history with nothing pointing at it: purge finds a Source's raw file only through the resource: of a concept that still exists, so it refused, and lint did not report the orphan. This makes the orphan visible and names the working way to erase it. purge's contract is unchanged.

• forget: when the removed Source's raw/<name> is still a file, it prints that the raw path remains on disk and in git history, and the sequence that erases it today: git revert <forget-sha> (while it is still the latest commit), then openkos purge <id> with the same scope the forget used. When no forget commit was made it says to restore the concept from git first. It is silent when no raw copy remains. lifecycle.py gains ForgetPlan.orphaned_raw; the path validation mirrors purge's check on a Source's resource.
• lint: a new advisory unreferenced-raw finding ("Unreferenced raw files:") from a names-only walk of raw/, reusing the already-collected documents and degrading to not-run on OSError. It is health opinion, not OKF conformance.
• Specs: forget-command ("Forget Discloses The Orphaned Raw Copy") and lint ("Unreferenced Raw File Scan"); docs/cli.md updated.

A one-command erasure (purge by raw path) is deliberately not part of this change; if wanted, it is a separate issue.

Related issue

Closes #1262

Type of change

• feat — new feature
• fix — bug fix
• docs — documentation only
• refactor — no behavior change
• test — tests only
• chore / ci — tooling, build, or CI
• Breaking change

How was this tested?

• An e2e test reproduces the issue's steps, parses the commands out of forget's own output, runs the revert and the purge, and checks the raw file is gone from the working tree and from git rev-list --objects --all. It and the two lint tests were observed failing first.
• Mutation: 5 mutants killed (two initial survivors — the is_file guard and the no-commit branch — got their own tests).
• ruff check, ruff format --check, mypy ., pytest --cov (96.45%), evals/run_self_tests.py (46/46) pass locally.

Checklist

• My commits follow Conventional Commits.
• I added or updated tests for the change.
• I updated docs where behavior, interfaces, or the knowledge model changed.
• Lint, format, type check, and tests pass locally (ruff, mypy, pytest).
• Output remains OKF-conformant and derived stores stay reconstructible from the bundle + sources.
• The change is consistent with the project's guiding principles (local-first, provenance, freshness, human-in-the-loop).