Fix quarantine evidence loss on eviction failure

[cursor]

Summary

• Make quota eviction stage all required victim pairs before deleting them, rolling staged files back if eviction cannot proceed.
• Protect the newly committed quarantine pair from post-commit eviction and remove it if quota enforcement ultimately fails.
• Defer retention cleanup until quota enforcement has succeeded, so failed writes do not purge older evidence.

Validation

• RED: PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py::test_quarantine_failed_eviction_stage_keeps_existing_entries -q failed against the pre-fix source.
• GREEN: PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py::test_quarantine_failed_eviction_stage_keeps_existing_entries -q -> 1 passed.
• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py::test_quarantine_failed_eviction_stage_keeps_existing_entries tests/test_security_regressions.py::test_quarantine_evicts_oldest_when_over_total tests/test_security_regressions.py::test_registry_fetch_layout_eviction_makes_room tests/test_security_regressions.py::test_root_write_evicts_oldest_registry_fetch_layout tests/test_security_regressions.py::test_quarantine_failed_content_write_does_not_evict_existing_entries tests/test_security_regressions.py::test_quarantine_failed_commit_does_not_evict_existing_entries -q -> 6 passed.
• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py tests/test_registry_fetch_r4.py tests/test_registry_ssot.py -q -> 58 passed.
• python3 -m compileall -q src/scp
• git diff --check

Note: full PYTHONPATH=src python3 -m pytest -q is currently blocked during collection by the known MCP 2.x / FastMCP dependency issue already covered by open PR #61.