fix(prune): Make prune workflow delete initdata

[shariqahmed-cohere]

Generating pr description

---

Note

Medium Risk
The workflow can delete attestation initdata files on disk; behavior is scoped to unreferenced orphans after prune, but mistakes in retire SHAs or manifest logic could remove policy artifacts.

Overview
Blobheart prune now removes initdata TOMLs that no longer appear on any surviving manifest target, not just entries in policy-manifest.yaml.

prune.py adds prune_initdata, which runs after the manifest is rewritten and unlinks attestation-policy/initdata/*.toml files whose basenames are not referenced by remaining targets. The Prune from Blobheart workflow is updated to treat the whole attestation-policy tree as the change surface: it validates each retire SHA as a 40-character hex commit, passes space-separated refs correctly into --retire, stages and uploads both the manifest and initdata/, and fixes PR stats to use ${{ steps.prune.outputs.* }} instead of broken shell variables.

A new test asserts that retiring a source drops orphaned initdata while keeping files still tied to surviving targets.

^{Reviewed by Cursor Bugbot for commit 76fff4c. Bugbot is set up for automated code reviews on this repo. Configure here.}