Garbage collector for the global content-addressable store.

Conservative candidate → quarantine → delete pipeline (PRD §14):

1. Build the reachable-hash set from GC roots: obj:* / obj_ver:* object metadata (content_hash) and active multipart part records (mpu_part:* hash).
2. Restore any quarantined blob whose hash became reachable again.
3. Unreachable active blob files older than the mtime grace become gc:candidate:{hash} records.
4. Candidates past eligible_after and still unreachable move to cas/gc/quarantine/sha256-{hash} (blob metadata → :quarantined).
5. Quarantined entries past their second eligible_after and still unreachable are deleted: file, blob metadata, candidate record.

Reachability is re-checked at every stage, so a blob that regains a reference at any point is never deleted. The legacy ContentGC owns the legacy bucket-local tree; this module only touches cas/objects and cas/gc/quarantine. Loose fallbacks retained for packed blobs are owned by Packer cleanup and are never GC candidates.

Configuration (app env, overridable per run_now/1 call):

• :cas_gc_interval — sweep interval ms (default 30 min)
• :cas_gc_orphan_mtime_grace — seconds a file must be unmodified before it can become a candidate (default 600)
• :cas_gc_candidate_grace — seconds before a candidate may be quarantined (default 3600)
• :cas_gc_quarantine_grace — seconds before a quarantined blob may be deleted (default 86_400)