Orphan sweep leaves a data-bearing mirror slot on a Server that enforces device approval#4142

Found while landing E6 (Restore and Mirror removal under device approval).

When a Volume with a Mirror is deleted, its Mirror's slot becomes an orphan. On a Server that enforces device approval, a slot that holds data is destroyed only under a Mirror removal a Device signs. The orphan sweep's run can't carry one, so since E6 the sweep skips that slot and logs Orphan slot kept: it holds data on a Server that enforces device approval. on every pass. Empty slots, such as one a failed Mirror left, are still swept.

Effect. The slot's data stays on the Server's disk with no Volume to name it. ployz volume mirror rm can't reach it because the Volume is gone from the config.

Workaround. ployz device enforce --off from an approved device, wait for the next sweep, then ployz device enforce.

Fix direction. Let a Device sign the cleanup: either the Volume's deletion signs removals for its Mirrors (with RemoveVolume, gap 8, owned by F5), or a CLI command lists orphan slots and signs their removal.

Scores. Frequency 2 (needs a deleted Volume with a Mirror on an enforcing Cluster). Severity 3 (disk space held; no data loss, nothing exposed).