sp pin/unpin — exempt scratches from reaping

[rwrife]

Closes #34

Adds a first-class pin so a scratch can be kept safe from sp reap without lying about its TTL.

What changed

• index: Scratch.Pinned bool (json:"pinned,omitempty") — backward-compatible; absent key decodes to false on existing indexes.
• store: SetPin(id, pinned) (metadata-only, idempotent). Reap (and --dry-run) now skips pinned live scratches and tallies them in ReapPlan.PinnedSkipped.
• cli: sp pin <id> / sp unpin <id> registered on root, with tombstone-flavored, idempotent confirmations. Reap summary reports how many pins it spared.
• render: sp ls shows 📌 on a TTY, PIN token in plain output; --json carries "pinned": true. Secret 🔑 marker unchanged.
• README + sp ls/quickstart help updated.

Tests

• store: pin round-trips through the index; reap skips pinned (real + dry-run) and counts them.
• render: 📌 glyph on TTY, PIN token in plain, pinned in JSON, reap summary skip note (incl. the "nothing to reap" line).
• cli: full pin → ls --json → idempotent re-pin → unpin round trip.

All acceptance-criteria boxes covered. go build, go vet, go test ./... green; new/changed files gofmt-clean.