[Ava-91]

Phase 7 — guarded Mirror execution

• Adds a read-only Mirror preview bound to the selected master direction, normalized backup root, exact operation list, skipped items, and blockers.
• Adds execution only with exact MIRROR confirmation, a fresh complete scan, a matching preview token, and a backup root outside both libraries.
• Uses the existing Mirror transaction engine, which creates and verifies a destination backup before mutation; unresolved fuzzy matches and blocked previews cannot execute.
• The desktop UI displays the complete operation list, with separate full deletion and replacement lists before the confirmation gate.
• Tests use temporary directories and synthetic WAV files only; they cover deletion backup, exact confirmation, token tampering, and unsafe backup locations.
• Restore remains locked for Phase 8.