Executor work directories are never removed after a proposal is done

Every executor clones into ctx.work_dir(pid) (~/.ion/work/<pid>/). These clones include merge targets, split filtered and verify-source clones, removal and pointer clones, and one clone per repo for autofix. They have to survive between runs, because Executor.clone skips a clone whose .git exists so that a multi-run proposal can resume.

Nothing removes them once the proposal reaches done (or failed, rejected or dropped). The only shutil.rmtree in ion/ is in fleet.py, for the preview directory (fixed in #59). On the Mac LaunchAgent, ~/.ion/work/ therefore grows by a full clone of every repo ion has ever merged, split, moved or autofixed.

Suggested fix: when after_phase sets a proposal to done, shutil.rmtree(ctx.work_dir(pid), ignore_errors=True). Do the same when a proposal leaves the live statuses. If keeping them for forensics is intended, a line in the README and an ion subcommand (or a doctor warning above a size) to prune them would settle it.

Automated posting by agentic team with human oversight.

Implementation draft awaiting independent code review: #84