Add opportunistic inline-script TTL eviction (PEP 723 PR 14/16) - #1745

Part of #1602 (PEP 723 inline script env support). Design doc: #1601.

Roadmap context

This is PR 14 of 16 in the PEP 723 inline-script roadmap. PR 13 added explicit, user-confirmed cache cleanup; this PR adds the separate best-effort TTL path.

Why this PR

Inline-script environments are dependency/interpreter-keyed and intentionally rebuilt instead of synchronized in place. Without lifecycle cleanup, old cache keys accumulate whenever dependencies or the selected Python change.

The design calls for a pipx-style 14-day TTL in addition to the explicit clear command. Because TTL cleanup is silent, it must be more conservative than user-confirmed cleanup and must never prevent the requested environment from being created.

What this PR does

• Attempts one TTL sweep per InlineScriptEnvManager session.
• Runs the sweep before the first environment creation/reuse reaches the cache.
• Reads only valid .meta.json sidecars and selects entries whose lastUsedAt is strictly older than 14 days.
• Reuses PR 13's physical-root, normal-directory, direct-child, and entry-lock safety checks.
• Re-reads lastUsedAt under the entry lock before deletion.
• Preserves held, retained, malformed, redirected, unavailable, or failed-to-delete entries.
• Treats all TTL failures as best-effort warnings and continues the triggering creation.
• Invalidates persisted and warm script associations only for entries confirmed deleted or definitively removed by another host.
• Removes evicted environments from the discovered collection and emits the existing environment-change events.
• Prevents a concurrent discovery refresh from publishing a stale snapshot after eviction.

Eviction semantics

Concurrency and safety

• The once-per-session latch is set synchronously, so concurrent creates share one sweep.
• The sweep uses the existing cache-maintenance then selection-queue ordering.
• The active-create counter is incremented before the sweep, preserving PR 13's clear-vs-create behavior.
• Each deletion is protected by the existing cross-host cache-entry lock.
• Physical root and entry containment are revalidated after lock acquisition.
• A cache mutation revision prevents stale discovery publication without waiting on, or deadlocking with, a refresh already blocked by maintenance.
• Only ENOENT counts as confirmed cross-host deletion; permission and transient access errors preserve associations.

Performance

• The cache is scanned once per extension-host session, not on every lookup.
• Entries are inspected and deleted sequentially to avoid I/O spikes.
• Activation remains unchanged and is not blocked by TTL work.
• Environments with missing or uncertain metadata are not repeatedly modified.

User impact

The feature remains behind python-envs.inlineScripts.enabled. Users without inline-script environments see no behavior change. Existing environments are retained unless a valid sidecar proves they have not been successfully reused for more than 14 days.

Tests

• npm run compile-tests
• npm run compile
• npm run lint
• Complete unit suite: 1,928 passing, 6 pending

Focused coverage includes:

• strict 14-day cutoff;
• once-per-session and failed-sweep behavior;
• under-lock freshness revalidation;
• held and retained lock preservation;
• deletion and persistence failure isolation;
• cross-host deletion confirmation;
• association and discovered-collection invalidation;
• refresh-versus-eviction publication races;
• unchanged explicit clear-cache behavior.

Scope and follow-up

This PR does not add telemetry, activation-time cleanup, a cache-root lock, project-setting cleanup, UX, or retry loops. Explicit clear-cache behavior remains unchanged.