retention piece 1: immediate rotations for chat-history / job-log / followups (b67084660385)

- chat-history.jsonl rotates at 10MB or 7d -> logs/archive/*.jsonl.gz + .sha256
- job-log.jsonl rotates at 2MB or 14d -> same archive layout
- followups.json archives resolved>7d / escalated>30d -> followups.archive.jsonl (append-only)
- verify wrapper: sha256 -c, gzip -t, clean listing, spot-extract JSON + ts bounds
- driver + hourly systemd user timer (retention-rotations.timer)
- archive-only: nothing is ever deleted; thread backfill excluded (needs human-reviewed preview)
First run 2026-10-05 16:35Z: chat-history 29.7MB + job-log 4.7MB rotated and verified; followups 0 eligible of 163.

bin/retention-run-rotations.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# retention-run-rotations.sh — retention piece 1 driver (board bug b67084660385).
+# Runs all three piece-1 rotations (chat-history, job-log, followups archive)
+# then verifies every archive touched. Idempotent: no-op when under threshold.
+# A full run report is appended to logs/retention-runs/retention-run-TS.log.
+# Exits 2 if any rotation or verification fails (so the timer run is loud).
+set -uo pipefail
+
+ROOT="${NETVM_ROOT:-/home/super/Projects/NetVM}"
+BIN="$ROOT/bin"
+ARCHIVE_DIR="$ROOT/logs/archive"
+RUN_TS="$(date -u +%Y%m%d-%H%M%S)"
+LOGDIR="$ROOT/logs/retention-runs"
+mkdir -p "$LOGDIR"
+LOG="$LOGDIR/retention-run-$RUN_TS.log"
+
+{
+echo "=== retention-run $RUN_TS (UTC) ==="
+
+fail=0
+
+"$BIN/retention-rotate-chat-history.sh" || fail=1
+"$BIN/retention-rotate-job-log.sh"     || fail=1
+"$BIN/retention-archive-followups.py"  || fail=1
+
+echo "--- verification ---"
+
+# Verify the newest chat-history / job-log archives (skip if none exist)
+for pattern in "chat-history-*.jsonl.gz" "job-log-*.jsonl.gz"; do
+  newest="$(ls -t "$ARCHIVE_DIR"/$pattern 2>/dev/null | head -1 || true)"
+  if [ -n "$newest" ]; then
+    "$BIN/retention-verify-archive.sh" "$newest" || fail=1
+  else
+    echo "SKIP verify: no $pattern in $ARCHIVE_DIR"
+  fi
+done
+
+# Verify the followups archive (append-only, cumulative)
+"$BIN/retention-verify-archive.sh" "$ROOT/followups.archive.jsonl" || fail=1
+
+echo "--- live sizes after run ---"
+ls -la "$ROOT/logs/chat-history.jsonl" "$ROOT/job-log.jsonl" "$ROOT/followups.json" 2>/dev/null || true
+
+echo "=== retention-run done rc=$fail ==="
+exit $fail
+} 2>&1 | tee -a "$LOG"