cli: 'aborist burn-kindergarten' — mass-burn fresh providence rows

Per fox: useful while iterating on retrieval/verifier knobs to wipe
recent test runs without finding each cache_key. Mirrors the mesh-sync
kindergarten window so what's still un-broadcast (private to this peer)
is exactly what's safe to bust without confusing peers.

Surface:
  aborist burn-kindergarten [--kindergarten-seconds N]
                            [--reason '...'] [--by-actor X]
                            [--force] [--dry-run] [--verbose N]
  make burn-kindergarten [SECONDS=3600] [FORCE=1] [DRY_RUN=1] [REASON='why']

Behavior:
- Walks every shard, finds providence_cache rows with
  created_at >= now - SECONDS and falsification_state='live'.
- Each row goes through the existing _burn_cache_key — children gate
  honored unless --force, audit event written per successful burn,
  chain integrity preserved.
- Result JSON reports examined / burned / refused_has_children /
  not_found counts plus a verbose tail of per-row results.
- --dry-run reports without writing or auditing.
- --kindergarten-seconds 0 = burn every live row (test reset).

Tests (4): selective burn (old kept, fresh burned), dry-run writes
nothing, 0-second window burns everything, children-gate refusal
without --force. 353 passed, 1 skipped.

Operational note: this command does NOT propagate to peers (burn is
local kindergarten cleanup by design, see docs/mesh.md). If you want
the remote effect, falsify each record individually & let mesh sync
broadcast the falsifications instead.

Makefile

@@ -31,7 +31,7 @@ SEARCH_Q     ?= computer
         ingest-grok ingest-grok-media \
         ingest-self ingest-git ingest-hg \
         verify search stats test docs chain-check chain-check-shards \
-        falsify burn inspect bootstrap-crawler test-crawler crawl-ingest \
+        falsify burn burn-kindergarten inspect bootstrap-crawler test-crawler crawl-ingest \
         recrawl-check clean clean-db clean-data help
 
 all: bootstrap fetch-cur ingest-cur verify stats ## bootstrap → fetch cur → ingest cur → verify → stats
@@ -140,6 +140,18 @@ burn: bootstrap ## delete a leaf with no children. providence: KEY=<cache_key>;
 	  echo "unknown KIND: $$kind (expected: providence|document|core)" >&2; exit 2; \
 	fi
 
+# Mass-burn providence_cache rows younger than the kindergarten window.
+# Mirrors mesh sync's kindergarten so what's still un-broadcast is what's
+# safe to bust without confusing peers. Useful while iterating on
+# retrieval/verifier tunings — wipe recent test runs in one shot.
+KG_SECONDS ?= 3600
+burn-kindergarten: bootstrap ## bust providence rows < SECONDS old [SECONDS=3600 FORCE=1 DRY_RUN=1 REASON='why']
+	$(ABORIST) --shards-dir $(SHARDS_DIR) burn-kindergarten \
+	    --kindergarten-seconds $(KG_SECONDS) \
+	    $(if $(REASON),--reason "$(REASON)",) \
+	    $(if $(FORCE),--force,) \
+	    $(if $(DRY_RUN),--dry-run,)
+
 # Multi-source RAG query against the shard cluster.
 # Usage: make query Q="What is anarcho-capitalism?"
 QUERY_TOP_K ?= 8