feat: improve app cleanup with orphaned LaunchAgent detection

New features:
- Add orphaned LaunchAgent/LaunchDaemon detection with 5-layer verification
  - Layer 1: Check if program path exists
  - Layer 2: Verify AssociatedBundleIdentifiers via mdfind
  - Layer 3: Check Application Support directory activity (7 days)
  - Layer 4: Fuzzy match app name in /Applications
  - Layer 5: Special handling for PrivilegedHelperTools
- Only process user-level ~/Library/LaunchAgents (safer than system-level)
- Unload agent before removal using launchctl

Bug fixes:
- Handle paths with spaces correctly in orphaned_app_data cleanup
  - Add nullglob state management to prevent word splitting
  - Use IFS=$'\n' for proper array iteration
- Only count successful deletions (check safe_clean return value)

Tests:
- Add 4 new tests for is_launch_item_orphaned edge cases
- Add tests for space handling and deletion count accuracy

bin/clean.sh

@@ -970,6 +970,7 @@ perform_cleanup() {
     start_section "Uninstalled app data"
     clean_orphaned_app_data
     clean_orphaned_system_services
+    clean_orphaned_launch_agents
     end_section
 
     # ===== 13. Apple Silicon optimizations =====