Scoped-delete semantics for --filter + --delete-unmatched

### Problem or use case

In #215, combining `--filter` with `--delete-unmatched` was intentionally left to fail fast until
scoped-delete semantics are designed:

> Combining `--filter` with `--delete-unmatched` should fail fast with a clear error until
> scoped-delete semantics are designed.

Designing and enabling that combination would allow deletion tracking for a filtered subset of the
artifact tree, rather than requiring a full-tree `--delete-unmatched` run just to track any
deletions at all.

### Proposed solution

Is there a plan or timeline for designing scoped-delete semantics, or a place to follow along?

As a workaround, expanding the following:

```diff
export function hasMutuallyExclusivePublishOptions(
deleteUnmatched: boolean,
_commitId?: string,
hasFilter = false
): boolean {
- return deleteUnmatched && hasFilter;
+ return deleteUnmatched && hasFilter && !_commitId;
}
```

produced correctly-scoped create/update/delete requests when tested against a simple,
self-contained API with no shared dependencies, but this doesn't address resources with shared dependencies that would need more thoughtful deletion orchestration.

### Affected command

apiops publish

Start with the apiops publish command and hasMutuallyExclusivePublishOptions, then review issue #215 for the existing fail-fast behavior. Define scoped-delete semantics for filtered artifact trees, including shared dependencies, and document or implement the agreed behavior so filtered create, update, and delete requests are correctly orchestrated.

Written by the indexing model from the issue text.