Checkpoint restore (git clean -fd) permanently deletes all untracked files

### Describe the bug

## Describe the bug

When using "restore to checkpoint" (triggered by pressing Escape during an agent run and choosing to restore), the `SnapshotManager.rollbackToSnapshot()` method runs `git clean -fd` on the repository root. This **permanently deletes all untracked files and directories** in the repo — including large output files generated by external processes that the agent never touched.

In my case, this destroyed ~1GB+ of evaluation output data (`.jsonl` and `.xlsx` files) across multiple directories under `output/` that were generated by a Python script the agent ran. The agent only *read* these files — it never created or modified them — yet they were all deleted by the checkpoint restore.

## Root cause (from source analysis)

The rollback flow in `rollbackToSnapshot()` calls:

1. `trr(gitRoot, gitCommit, gitBranch)` → runs `git checkout --force` + `git reset --hard`
2. **`qnr(gitRoot)` → runs `git clean -fd`** ← this is the destructive operation

`git clean -fd` removes **all** untracked files and directories. The snapshot system only backs up files that the agent itself created/modified. Any files created by external processes (scripts, builds, test output, data pipelines) that happen to be untracked are silently and permanently deleted.

## Affected version

0.0.417 (but the code is present in earlier versions too — at least 0.0.411+)

## Steps to reproduce

1. Have a git repo with untracked files/directories not in `.gitignore` (e.g., `output/` with large data files)
2. Start a Copilot CLI session in that repo
3. Have the agent run a command that generates output files (e.g., `uv run python script.py` that writes to `output/`)
4. Press Escape twice to cancel the agent mid-run
5. Choose "Restore to this checkpoint" when prompted
6. All untracked files/directories are now deleted — including the output files from step 3

## Expected behavior

Checkpoint restore should **not** delete untracked files that the agent didn't create. Possible fixes:

1. **Only clean files the agent created**: Track which files were created by agent tool calls and only remove those
2. **Skip `git clean` entirely**: The snapshot already tracks and restores individual files — the `git clean` is a blunt hammer on top
3. **Warn the user**: At minimum, show "This will delete X untracked files (Y MB). Proceed?" before running `git clean -fd`
4. **Move to trash instead of delete**: Use OS trash/recycle bin so files can be recovered

## Additional context

- The `output/` directory was **not** in `.gitignore` (user's mistake, now fixed), but even repos with proper `.gitignore` could lose untracked files in directories that aren't ignored
- The data loss is permanent — `git clean -fd` doesn't use the recycle bin
- This is especially dangerous for repos that generate large output artifacts (ML training, data pipelines, evaluation benchmarks)
- The `SESSION_CLEANUP` feature flag is set to `"staff-or-experimental"`, suggesting this is still being refined

### Affected version

0.0.417

### Steps to reproduce the behavior

_No response_

### Expected behavior

_No response_

### Additional context

_No response_