bregctl dev: no way to find or prune containers and volumes of deleted projects

## Use Case

A developer or a verifier creates many short-lived `bregctl dev` projects (temporary directories for tests, tutorials replayed from scratch) and deletes the project directories when done.

## What we hit

`bregctl dev stop` keeps the owned PostgreSQL container and its named volume by design, and `dev stop --remove` reclaims them for a project that still exists. Once a project directory is gone there is no command left that can reclaim its storage:

- containers are named `breg-dev-` and carry only the `org.registrystack.bregctl.dev-owner` label;
- nothing records which project path owned them, so `docker ps -a` cannot tell a live session's container from an orphan;
- there is no `bregctl dev` command to list or prune them.

One development machine accumulated hundreds of exited `breg-dev-*` containers with volumes from verifier runs, and cleaning them required guessing ownership from creation times.

## Proposed Behavior

- Label owned containers and volumes with the canonical project path and the session creation time (both non-secret).
- Add `bregctl dev prune` (dry run by default, `--apply` to act) that lists owned containers and volumes whose project path no longer holds the matching session state, and removes only those.

## Boundaries

- Never remove a container or volume whose recorded project still holds matching state, or one without the owner label.
- No change to `dev stop` retention semantics.

Start by tracing the existing bregctl dev stop and dev stop --remove flows, including container and volume naming, owner labels, and session-state handling. Define how canonical project paths and creation times are recorded, then verify that dev prune defaults to a dry run, requires --apply to remove only orphaned owned resources, and preserves matching or unlabeled resources.

Written by the indexing model from the issue text.