[Feature]: Add cleanup safety guardrails for large or unscoped deletions

[mrhillsman]

Problem Statement

virtwork cleanup without --run-id deletes every resource with the app.kubernetes.io/managed-by: virtwork label in the configured namespace. Today there is no confirmation prompt before destruction, and the cluster-wide RBAC (namespaces, virtualmachines, etc. across all namespaces) means a typo in --namespace can silently target the wrong namespace. There is also no built-in protection against bulk-deleting many resources in a shared cluster.

This makes the cleanup command an operational sharp edge — fine in CI / dedicated test namespaces, risky in shared environments.

Proposed Solution

Add opt-in safety guardrails on virtwork cleanup. Suggested behaviors:

1. Confirmation prompt when the discovered resource count exceeds a threshold (e.g., 20 resources) and --run-id was not provided. Suppress with --yes for non-interactive use.
2. --dry-run first, then --apply (or --yes) to actually delete. Default cleanup behavior could become dry-run, mirroring kubectl apply --dry-run=client. This is the more disruptive change but the safest.
3. Print a summary before deleting — namespace, label selector, counts by resource type, distinct run-IDs found — and require explicit confirmation.

The exact UX is open. Even (1) alone would significantly raise the bar for accidental destruction.

Alternatives Considered

• Tighten RBAC so the deployed pod can only operate on a single namespace. Reasonable for the in-cluster deployment but doesn't help local CLI users.
• Require --namespace explicitly (no default). Stops the most common typo class but adds friction for the common case.
• Status quo: rely on operators to use --dry-run explicitly. Works today; this issue says it's not enough.

Area

Cleanup

Architecture Layer

Layer 4 - Orchestration (cmd, cleanup)

Additional Context

Surfaced while writing docs/deployment.md and docs/guide/02-deploying-workloads.md. The RBAC scope is documented in docs/deployment.md; the cleanup flow in cmd/virtwork/main.go cleanupE and internal/cleanup/cleanup.go.