feat(analyze): safer deletion with Trash and two-key confirm

- Change delete confirmation from double-delete to Delete→Enter
- Move files to macOS Trash instead of permanent deletion
- Allow file recovery from Trash if accidentally deleted
- Update UI prompts to show 'Press Enter to confirm'
- Skip Finder-dependent tests in CI environments
- Update SECURITY_AUDIT.md with new safety mechanisms

Closes #288

cmd/analyze/delete_test.go

@@ -6,7 +6,47 @@ import (
 	"testing"
 )
 
+func TestTrashPathWithProgress(t *testing.T) {
+	// Skip in CI environments where Finder may not be available.
+	if os.Getenv("CI") != "" {
+		t.Skip("Skipping Finder-dependent test in CI")
+	}
+
+	parent := t.TempDir()
+	target := filepath.Join(parent, "target")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatalf("create target: %v", err)
+	}
+
+	files := []string{
+		filepath.Join(target, "one.txt"),
+		filepath.Join(target, "two.txt"),
+	}
+	for _, f := range files {
+		if err := os.WriteFile(f, []byte("content"), 0o644); err != nil {
+			t.Fatalf("write %s: %v", f, err)
+		}
+	}
+
+	var counter int64
+	count, err := trashPathWithProgress(target, &counter)
+	if err != nil {
+		t.Fatalf("trashPathWithProgress returned error: %v", err)
+	}
+	if count != int64(len(files)) {
+		t.Fatalf("expected %d files trashed, got %d", len(files), count)
+	}
+	if _, err := os.Stat(target); !os.IsNotExist(err) {
+		t.Fatalf("expected target to be moved to Trash, stat err=%v", err)
+	}
+}
+
 func TestDeleteMultiplePathsCmdHandlesParentChild(t *testing.T) {
+	// Skip in CI environments where Finder may not be available.
+	if os.Getenv("CI") != "" {
+		t.Skip("Skipping Finder-dependent test in CI")
+	}
+
 	base := t.TempDir()
 	parent := filepath.Join(base, "parent")
 	child := filepath.Join(parent, "child")
@@ -32,12 +72,16 @@ func TestDeleteMultiplePathsCmdHandlesParentChild(t *testing.T) {
 		t.Fatalf("unexpected error: %v", progress.err)
 	}
 	if progress.count != 2 {
-		t.Fatalf("expected 2 files deleted, got %d", progress.count)
+		t.Fatalf("expected 2 files trashed, got %d", progress.count)
 	}
 	if _, err := os.Stat(parent); !os.IsNotExist(err) {
-		t.Fatalf("expected parent to be removed, err=%v", err)
-	}
-	if _, err := os.Stat(child); !os.IsNotExist(err) {
-		t.Fatalf("expected child to be removed, err=%v", err)
+		t.Fatalf("expected parent to be moved to Trash, err=%v", err)
+	}
+}
+
+func TestMoveToTrashNonExistent(t *testing.T) {
+	err := moveToTrash("/nonexistent/path/that/does/not/exist")
+	if err == nil {
+		t.Fatal("expected error for non-existent path")
 	}
 }