Add removal blast-radius safeguards

[captainpacket]

What changed

• add aggregate --max-removals and per-setup --max-removal-percent safety ceilings
• enforce the ceilings in NQE sync, manifest sync, apply-plan, webhook apply, and preflight
• add unit, API-contract, manifest, saved-plan, and preflight coverage
• document staged External ID rollback, release checksum/provenance verification, audit handling, and the new safety gates
• update the architecture and GovCloud Mermaid workflows

Why

--allow-removals confirms operator intent, but it does not cap the size of an accidentally broad removal plan. These limits give operators a second, quantitative gate that is evaluated against current Forward setup state immediately before PATCH.

Validation

• make ci
• go test -race ./...
• git diff --check
• 82 tests across 6 packages
• all affected command help surfaces verified
• release checksum and GitHub provenance commands exercised against v2.1.1
• read-only live preflight against SPGI/IHS: strict 10 / 5% limits blocked the 27-removal plan; reviewed 27 / 6% limits passed while the separate removal-approval gate remained blocked