feat(prune): R1 prune-reconcile pure core — (owned ∩ present) − referenced

Add REAPER-free/filesystem-free prune orphan-set core + additive
BankBook::referencedPaths() union query, with full unit coverage.

src/prune_reconcile.h

@@ -0,0 +1,63 @@
+#pragma once
+// prune_reconcile — the pure core of Phase R (Reclaim), Wave 1. The safety-critical
+// "which files are orphans" decision, computed with NO filesystem I/O and NO REAPER
+// types. The mirror of view_mode_model's reconcile(liveGuids), one level DOWN: it
+// reconciles FILES ON DISK against REFERENCED FILES (the union across every bank),
+// where reconcile reconciled membership entries against live tracks.
+//
+// PURE MODULE (CLAUDE.md §load-bearing split): NO REAPER types, NO SWELL, NO
+// vendor/ includes, NO filesystem calls. Standard library only. Unit-tested outside
+// the DAW — this is the safety-critical part (it decides which bytes get deleted in
+// R2/R3), so it is hard-tested here before any I/O exists.
+//
+// -- The one computation ------------------------------------------------------
+//
+//     orphans = (owned ∩ present) − referenced
+//
+//   * present    — files enumerated in the resolved current bank folder (R2 shell).
+//   * referenced — every project-relative path referenced by ANY bank in the book,
+//                  pool included (union across the whole book — see BankBook::
+//                  referencedPaths). A file referenced by any bank — including via a
+//                  COPY into a second bank — is NEVER an orphan (the prune null test).
+//   * owned      — the owned-file manifest: the files the bank system itself created
+//                  (OwnedFileManifest). A present-but-unowned (hand-dropped) file is
+//                  NEVER reclaimed — prune reclaims only the system's own leavings.
+//
+// The three settled guardrails fall straight out of the set algebra:
+//   * ∩ present    — never proposes deleting a file that is not on disk (an owned-
+//                    but-absent manifest entry yields no orphan, no error).
+//   * ∩ owned      — never a hand-dropped file (ownership attribution, fork R-D).
+//   * − referenced — never a file any bank references (union safety, prune null test).
+//
+// -- Path representation: EXACT-STRING match (safety-critical) -----------------
+//
+// Every path in the model is a project-relative string compared VERBATIM: Sample.
+// relativePath, OwnedFileManifest::contains (p == relativePath), and BankIndex all
+// use raw std::string equality — no separator normalization, no case-folding, no
+// trailing-slash trimming. This core MATCHES that convention exactly: it compares
+// the raw strings the shell supplies. Feeding a consistent spelling across the three
+// inputs is the R2 shell's contract (it enumerates the folder, unions the book, and
+// reads the manifest against the SAME resolved current folder). Diverging from exact
+// match here (e.g. case-insensitive compare) would be the unsafe direction — it could
+// let one spelling of a referenced file be treated as an orphan under another.
+
+#include <string>
+#include <vector>
+
+namespace reasampler {
+
+// Computes the prune orphan set: (owned ∩ present) − referenced.
+//
+// Returns the subset of `present` that is BOTH owned AND unreferenced, in the ORDER
+// they appear in `present` (deterministic output — mirror of the insertion-order
+// determinism the index / manifest keep; the R2 dry-run reports a stable file list).
+// Duplicate spellings within `present` are de-duplicated in the result (a folder
+// enumeration yields distinct names, but the core does not rely on that).
+//
+// Pure: no I/O, no REAPER, no hidden state. All three inputs are project-relative
+// path strings, compared by exact std::string equality (see header note).
+std::vector<std::string> pruneOrphans(const std::vector<std::string>& present,
+                                      const std::vector<std::string>& referenced,
+                                      const std::vector<std::string>& owned);
+
+} // namespace reasampler