Add a lightweight top-level entry cap to Containers and Group
Containers scanning. When a cache directory exceeds the threshold,
skip the expensive per-item du/find size scan and take a partial-size
/ "cleaned" output path instead. Replace find-piped-to-read loops
with pure-bash glob iteration to cut external process overhead.
Closes#586