Builds and optionally applies a conservative cleanup plan from HostKit release metadata.
Cleanup uses the same target selection flags as host_kit.plan and the same
confirmation model as host_kit.apply. Use --dry-run to inspect without
deleting anything, or --confirm to apply the generated cleanup commands.