feat(booth): kept boards can be deleted from the UI; document the TTL-reset trap

Kept boards had no delete path in the UI at all. The kept lane deliberately
omits the wipe control -- a one-click wipe next to the durable stuff is a
footgun -- but "deliberate" had been implemented as "impossible": the only
routes out were ssh or a hand-written API call.

Now it is two deliberate acts. A `release` control on kept cards drops the
sentinel, the board moves to the ephemeral lane, and the existing x wipes it
from there. Release is reversible -- POST /b/<name>/keep pins it again.

  POST /b/<name>/unkeep   release the pin
  POST /b/<name>/keep     pin it (round-trip, so release is not a one-way door)

FOUND WHILE TESTING, and it invalidates the previously-documented workaround:
removing the sentinel BUMPS the booth directory's mtime, and booth age is the
newest mtime in the tree -- so a released board's clock RESETS from 10,000s to
0s and it survives another full TTL. The old comment said "remove the sentinel
first (it rejoins the sweep)", which is true but means the board lives another
24h, not that it gets reaped. Unkeep-and-wait is a delay, not a delete.

test_releasing_a_board_RESETS_its_ttl_clock pins that behaviour deliberately so
nobody re-derives the workaround. Release is what unlocks the x; the x is what
deletes.

CLI: `booth rm` already worked on kept boards but said nothing about it. It now
announces "(was KEPT -- durable board)" so wiping something durable can never
look identical to wiping run output. Not a block -- a CLI user naming a booth
is being explicit.

5 new tests (67 pass). Verified live on nh3-dev: release renders on all four
kept boards, the ephemeral lane keeps its x, and the links board is untouched
with its sentinel intact.

services/booth/scripts/booth

@@ -20,6 +20,17 @@
 # durable operator-facing boards, not for run output. `unkeep` is just `rm` of
 # the sentinel, so putting a board back under the sweeper costs nothing.
 #
+# DELETING A KEPT BOARD: `booth rm <name>` works on kept boards too and deletes
+# NOW — it announces that the board was kept, so wiping something durable is
+# never silent. In the web UI it is two deliberate steps: `release` on the kept
+# card drops the sentinel, the card moves to the ephemeral lane, and the × wipes
+# it from there.
+#
+# DO NOT "unkeep and let it expire". Removing the sentinel BUMPS the booth
+# directory's mtime, and a booth's age is the newest mtime in its tree — so a
+# released board's clock RESETS and it survives another full 24h. Unkeep-and-wait
+# is a delay, not a delete. Use `rm` (or the UI ×) when you mean now.
+#
 # `link` is the reason the exception exists: agent sessions hand the operator
 # URLs that then drown in terminal scrollback. They go on a standing kept board
 # instead, with provenance, so they outlive the session that produced them.
@@ -66,8 +77,13 @@ case "$cmd" in
     ;;
   rm)
     [ $# -ge 1 ] || usage
+    # Say so when the thing destroyed was durable. Not a block — a CLI user
+    # naming a booth is being explicit — but a kept board disappearing must not
+    # look identical to run output disappearing.
+    was_kept=""
+    [ -e "$DATA/$1/$KEEP" ] && was_kept=" (was KEPT — durable board)"
     rm -rf -- "${DATA:?}/$1"
-    echo "wiped $1"
+    echo "wiped $1$was_kept"
     ;;
   keep)
     [ $# -ge 1 ] || usage