feat(55): stop leaving disk debts — temp clips and a low-disk guard

595 green, 0 warnings. Completes TASK 55 (slice 1, log rotation, shipped 2026-10-22).

- **`AlertClipCleanup`**: the default alert clip is materialised into `%TEMP%` for ffmpeg to read, and
  nothing ever deleted it — one orphan per profile that ever played an alert. Now: delete this session's
  file in `Shutdown`, and sweep `ytLive-alert-*.mp4` at startup for anything a crash left behind. Only
  the prefix we own is touched; a directory is never deleted.
- **`DiskSpaceGuard`**: a recording that dies of a full disk is a trust breach, so the numbers are a
  pure policy — refuse to start under **1 GB** (toast; the stream still starts, recording does not),
  warn under **5 GB** at start ("about eighty minutes" at 8 Mbps ≈ 3.6 GB/h), and one mid-show warning
  under **2 GB** — the last useful moment before the encoder fails for a reason it won't explain.
  Unreadable drives (a USB stick that just left) return null and never block a running recording.

Tests are policy-level on purpose: filling a real drive is not a test. `DiskHygieneTests` proves the
sweep only removes our own files and that the thresholds behave at both ends.

App.xaml.cs

@@ -26,6 +26,10 @@ public partial class App : Application
             AppLog.Write(args.Exception, "Dispatcher unhandled exception", AppLogErrorClass.Class1);
 
         AppLog.Write("App OnStartup begin");
+
+        // TASK 55·2: a crash leaves the same temp clip a clean exit would have deleted.
+        var sweptClips = ytLive.Services.AlertClipCleanup.Sweep(System.IO.Path.GetTempPath());
+        if (sweptClips > 0) AppLog.Write($"Temp alert clips removed at startup: {sweptClips}");
         // Attribution (2026-09-04): every take must be traceable to the exact binary
         // that produced it — the wordmark shows the release counter (BuildStamp.Release);
         // the per-build GUID is forensic only and lands here.