Check run homes (/data/checks/*.home) are removed when their run ends or dies, not only at the next boot #7545

Intent: 99 run homes (2.9 GiB) were left under /data/checks (#7541). Each one was a check or gate whose finally { rmSync(home) } in src/checks/service.ts never ran or failed, and sweepCheckouts only collects them at boot.

Done when:

• [ ] The cause is named in the pull: a forge killed mid-run, a lapsed lease, or an rmSync that threw on what the cell wrote (e.g. read-only files in a bun cache). It is fixed so an ordinary run never leaves its home behind. A failed removal is logged, never swallowed.
• [ ] sweepCheckouts treats <id>.home as belonging to run <id> (today getRun("x.home") is always undefined). It runs on the same timer that sweeps abandoned checks (sweepAbandonedChecks) as well as at boot, and still leaves a live run's directory alone during a roll.
• [ ] When a preview environment is torn down, its home goes with it (removeEnv in src/apps/data.ts). A test proves it.
• [ ] Tests: a home whose run is finished or lapsed is removed by the sweep; a live run's home survives it; a home containing a read-only file is still removed.

Files: src/checks/service.ts, src/apps/data.ts or src/apps/runtime.ts, tests.

Risks: two forges share /data during a roll, so the lease check must stay exactly as strict as it is for checkouts.

Brief: any builder; small and self-contained.

A first cut of this (sweep keyed to homes and gates, removeTree in preview/app teardown, 30 s sweep) is commit 689ff5da on torque/7541-p0-efficiency-every-contained-check-gate, reverted out of #7568 on review. When it lands in its own pull it needs: no throwing removeEnv/removeApp (or callers tested on the failing path), a minimum age by mtime before a directory is swept, and the removal off the event loop or in bounded batches. src/kernel/remove_tree.ts itself lands with #7568.