Adds sweep-orphans.sh (safe-by-allowlist: removes orphan test stacks, standalone debug containers >30m old, leaked dangling volumes, and reparented docker-run wrappers; spares infra + warm-* canonicals and their retained volumes) and wires it as Step 0 of /upgrade-all so a prior run's leaked stack/container/process can't contend for the shared Swarm or skew the survey. Idempotent; no-op when clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>