store: recover content a --retire-source run cannot fold #810

What

Source retirement (#806, #807) never deletes a file it has not verified in the destination, so nothing below is lost. But two shapes of a source store are preserved without any way to finish the retire, short of handling files by hand:

1. Content no record refers to. The fold copies only content that some source event references (build_export_manifest, src/session/store/bundle.rs:105 at 20a61b5e). A content file in the source that no source event names, for example a lock-free content put whose event never landed there, is never folded. Subset verification then fails on every rerun, so --retire-source keeps refusing and keeps deleting nothing. Pinned by orphan_content_after_verification_survives_and_rerun_refuses.
2. A content-only remainder. A lock-free content put that lands after retirement's pre-deletion scan, while unlinking is under way, survives, but it can leave a store with content files and no event files. Pinned by late_files_during_deletion_survive. After that:
   • store migrate --retire-source refuses it outright (RetireSourceShape::ArtifactsWithoutEvents, src/session/workflow/store_migrate_common_dir.rs:181);
   • store link treats it as an empty store and silently skips it (fold_source_forward, src/session/workflow/store_link.rs:506). This part predates retirement.

docs/storage-model.md § Source Retirement tells the operator to inspect such files by hand.

Acceptance sketch

• An explicit, opt-in recovery for content files a retire cannot fold. It reports each file's content hash and whether the destination already has it, and offers to import the missing ones as unreferenced content (or quarantine them) without inventing events.
• store link no longer silently skips a content-only clone store: at least a diagnostic names the remainder, matching store migrate's refusal.
• Nothing is deleted unverified; the existing retirement guarantees stay as they are.