feat(cold-storage): export model placement inventory

[tang-vu]

?## Summary

• add order-independent --status --json to LLM cold-storage tooling
• inventory hot directories, cold-storage symlinks, and archived physical copies
• report idle days, protection/in-use flags, paths, totals, and human-readable sizes
• replace the single-position command switch with validated mutually-exclusive actions

Why this matters

Operators need to know which model artifacts occupy NVMe versus backup storage before capacity planning, moving disks, or restoring a model. The existing prose status is useful interactively but cannot feed dashboards, fleet inventory, or support evidence reliably.

Behavioral invariant: JSON status is read-only and classifies the same cache/cold directories, protected models, process usage, and access age as the human status path.

Overlap check

Searched open and closed PRs for llm-cold-storage, cold storage JSON, and production file ods/scripts/llm-cold-storage.sh. PR #2627 configures retention age, #3638 adds a maximum storage limit, and #2365 repairs archive destination creation. None exports status. This PR does not change archive/restore policy and preserves each PR's independent advantage.

Test plan

• bash -n ods/scripts/llm-cold-storage.sh
• bash ods/tests/test-llm-cold-storage-json.sh
• git diff --check
• bats ods/tests/bats-tests/macos-bsd-compat.bats (BATS unavailable locally; CI remains the macOS contract gate)

The boundary fixture creates a hot model, archived model, and cache symlink; it parses the real status JSON, verifies the three physical/logical states and summary, and checks that JSON cannot select a mutating default action.

Tradeoffs, portability, and rollback

Sizes remain human-readable du values rather than byte counts to preserve parity with the existing command. Linux and macOS retain their respective access-time probes; Windows uses WSL. No live archive/restore was performed. Rollback restores positional command parsing and prose-only status without moving data.

Generated with Codex

Batch compatibility

This PR is independently mergeable. For the September feature batch, the tested order is #3647 ? #3656. All ten heads cherry-picked without conflict onto upstream/main@6ff9b4fc; the resulting synthetic integration head was 17e0791c.

Combined validation: all focused boundary suites passed, make lint passed, and every GitHub Actions check on all ten PRs passed. make test reaches the pre-existing Hermes template bounds each model turn failure; the same command/failure was reproduced on a clean upstream/main@6ff9b4fc worktree. No live hardware, physical-print, archive/restore, or deployment claim is inferred from static/simulated validation.