Evidence-use retention: configurable duration, digest-only mode, in-process sweeper

Found in the 0.28.0 pre-release review (2026-09-08). Line references are as of main after #926.

A governed action that resolves an Evidence assertion retains the full signed response plus verification context (`crates/registry-breg/src/action_evidence_client.rs:221-240`) in `registry_internal.registry_action_evidence_uses` for a hard-coded `ACTION_EVIDENCE_RETENTION_SECONDS = 24 * 60 * 60` (line 26). The only eraser is the operator command `bregctl evidence-retention erase-expired`, compiled under the `tooling` feature (`action_evidence_maintenance.rs`). This follows the existing operator-run pattern for request retention and history erasure, which is why 0.28.0 ships it as is (see `products/breg/DECISIONS.md`). It still means a default deployment keeps signed personal assertions past their stated expiry until an operator schedules the command.

Decisions needed:
1. Retention shape: keep the signed response, or retain a verification digest plus decision by default with the full response as an opt-in. Digest-only removes the 1 MiB retained-size check and most of the retention story, at the cost of re-verification inside the window.
2. Whether retention becomes an operator setting (mirroring `payloadRetentionDays` in `runtime_config.rs`) with 24 hours as the default.
3. Whether the runtime sweeps expired rows itself, for this scope and for the request-retention and history scopes that share the operator-run pattern.

Security-sensitive (data minimization); needs explicit review notes when implemented.

Start with products/breg/DECISIONS.md and the retention flow in crates/registry-breg/src/action_evidence_client.rs:221-240, including ACTION_EVIDENCE_RETENTION_SECONDS at line 26. Read action_evidence_maintenance.rs and runtime_config.rs to compare the existing operator-run patterns. This issue is done only after the retention shape, configuration, sweep scope, implementation, and required security review notes are explicitly settled.

Written by the indexing model from the issue text.