cleanup candidates keep resurfacing without last fresh blocker evidence

[chubes4]

Problem

DMC hygiene repeatedly lists the same 8 cleanup candidates as pending fresh revalidation, even after bounded apply freshly proves they are blocked by dirty worktrees or unpushed commits.

Evidence

• Hygiene repeatedly listed 8 cleanup_eligible rows with fresh_status=not_run_inventory_only and fresh_blockers=pending_fresh_revalidation.
• Direct bounded apply showed the durable blockers: 4 unpushed_commits, 4 dirty_worktree plus unpushed commits.
• Later safe cleanup runs still listed the same 8 as candidates rather than surfacing the last known blocker.

Expected

After a fresh bounded cleanup attempt, hygiene should show the last observed fresh blocker for each candidate, with timestamp/source, rather than only saying pending fresh revalidation.

Impact

Operators rerun cleanup loops that cannot make progress and may assume the cleanup command is broken.

Acceptance criteria

• Fresh blocker evidence from bounded cleanup apply is persisted or reflected in hygiene.
• Hygiene displays blocker reason summaries for cleanup-eligible rows when known.
• Safe cleanup recommendations stop suggesting zero-yield loops without new evidence.