pixi: add root clean task for stale build artifacts

Moving a checkout between the cu12 and cu13 pixi environments leaves
compiled Cython extensions, generated .pyx/.cpp sources, and the
cache_driver/cache_runtime/cache_nvrtc parser caches from the previous
CUDA major behind. The next build then fails with errors that point at
code which is fine, and the fix -- knowing which of the many ignored
paths to delete -- is folklore.

Add `toolshed/clean.py` plus two tasks:

  pixi run clean-dry-run   # list what would be removed
  pixi run clean           # remove it

The artifact list comes from `git status --ignored` rather than a
hand-maintained glob list, so tracked files are never at risk -- notably
the handful of *.cpp files that are checked in despite the blanket *.cpp
ignore rule (param_packer.cpp, loader.cpp, *_impl.cpp).

Deletion is then restricted by an allowlist of repository-owned paths, so
an unrecognized ignored directory is preserved rather than removed just
for being ignored. `.pixi` and hand-made virtualenvs are protected at any
depth: they are expensive or developer-local, and never the cause of a
stale-artifact build failure.

An earlier attempt used `git clean -Xdf` with `:(exclude)` pathspecs
instead of a script. That was dropped: on git 2.43 the presence of an
exclude pathspec changes matching for the positive pathspecs too, so the
command silently removed paths outside the directories it was given.

Verified with a dry run on a dirty worktree (212 paths, 698 MiB) and unit
checks of the path-classification rules.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: rparolin